CHFI: Computer Hacking Forensics Investigator v8

EC-Council CHFI Computer Hacking Forensics Investigator Course Curriculum:

Module 01: Computer Forensics in Today’s World

Forensics Science
Forensics Readiness
Cyber Crime
Cyber Crime Investigation
Cyber Crime Investigation
Corporate Investigations
Reporting a Cyber Crime
Module 02-03: Computer Forensics Investigation Process

Before the Investigation
Build a Forensics Workstation
Building the Investigation Team
Acquire Authorization
Obtain Search Warrant
First Responder
Collect Physical Evidence
Collect Electronic Evidence
Secure the Evidence
Chain of Custody
Imaging
Data Analysis
Investigation Report
Expert Witness
Professional Conduct
Module 04: Digital Evidence

Increasing Awareness
Increasing Awareness
Anti-Digital Forensics
Digital Data
Rules of Evidence
International Organization on Computer Evidence
Electronic Devices
Examination Process
Evidence Assessment
Evidence Acquisition
Evidence Acquisition
Evidence Acquisition
Evidence Preservation
Evidence Examination and Analysis
Evidence Documentation and Reporting
Module 05: First Responder Procedures

Electronic Evidence
Roles of First Responder
Evidence Collecting
Initial Search
Collecting and Preserving Electronic Evidence
Collecting and Preserving Electronic Evidence
Common Mistakes
Module 06: Computer Forensics Lab

Planning for a Forensics Lab
Licensing
Investigative Services
Equipment
Software
Module 07: Understanding Hard Disks and File Systems

Disk Drives
Cluster
Slack Space
Disk Partitions
Master Boot Record
Boot Process
File Systems
Windows File Systems
Linux File Systems
Mac OS X File Systems
RAID Storage System
File Carving Process
Module 08: Windows Forensic

Volatile Information
System Time
Network Information
Process Memory
Non-Volatile Information
Slack Space Continued
Collecting Hidden Partition Information
Memory Dump
Extracting the Process Image
Inside the Registry
Time Zone Information
Wireless SSIDs
Mounted Devices
Cache, Cookie and History Analysis in IE
MD5
Recycle Bin
Prefetch Files
Executable File Analysis
PE Header Analysis
Metadata
Events
Windows Password Storage
Windows Forensics Tool
Module 09: Data Acquisition and Duplication

Formats
Methods
Mistakes
Static Data
Live Data
Disk Imaging Tool Requirements
Validating Data Acquisitions
Remote Data Acquisition
Best Practices
Module 10: Recovering Deleted Files and Deleted Partitions

Deleting Files
Recycle Bin Continued
File Recovery in Mac OS X
File Recovery in Linux
Module 11 – 12: Using AccessData FTK

Using AccessData FTK
Module 13: Steganography and Image File Forensics

What is Steganography
Steganography Techniques
Steganography Techniques
Steganalysis
Module 14: Application Password Crackers

Terminology
Password Cracker
Password Cracking Techniques
Active Online Attack
Non-Electronic Attacks
System Software Password Cracking
Module 15: Log Capturing and Event Correlation

Computer Security Logs
Router Log Files
Configuring Windows Logging
Log File Accuracy
Keeping Time
UTC Time
Legality of Using Logs
Laws and Regulations
Log Management
Centralized Logging
Syslog
Event Correlation
Module 16: Network Forensics and Investigating Network Traffic

Intrusion Detection Systems
IP Address Spoofing
Denial of Service
Trojan Horse
Injection Attacks
Postmortem and Real Time Analysis
Module 17: Investigating Wireless Attacks

Wireless Standards
Service Set Identifier
Types of Wireless Encryption
Wi-Fi Chalking
Availability Attacks
Identify Wireless Devices at Crime Scene
Features of a Good Wireless Forensics Tool
Module 18: Investigating Web Attacks

Introduction To Web Applications
Web Attacks
Unvalidated Input
Parameter/Form Tampering
Injection Flaws
SQL Injection Attacks
Cross-Site Scripting
Improper Error Handling
Web Attack Investigation
Investigating Cross-Site Scripting
Investigating SQL Injection Attacks
Module 19: Tracking Emails and Investigating Email Crimes

SMTP Server
POP3 and IMAP Servers
E-mail Message
Investigating E-mail Crime and Violations
Examine E-mail Headers
Analyzing E-mail Headers
Examining Additional Files
Forensic Acquisition of E-mail Archive
Deleted E-mail Recovery
Forensic Tool Kit
CAN-SPAM Act
Module 20: Mobile Forensics

Mobile Phone
Mobile Phone Forensics
Precautions to Be Taken Before Investigation
Mobile Devices
Module 21: Investigative Reports

Computer Forensics Report
Features of a Good Report
Computer Forensics Report Template
Report Classification
Attachments and Appendices
Writing a Report Using FTK
Module 22: Becoming an Expert Witness

What is an Expert Witness
Technical vs. Expert Witness
Preparing for Testimony
Expert Witness Qualifications
Importance of Resume
Testifying in Court
General Ethics
Helping Your Attorney
Deposing
Dealing with Media
Module 23: Lab

Imaging with FTK Device
Steganography Detection
Network Attacks Network Miner & Wireshark
Acquiring Memory Images