7 Topics
5 Days
32 Sessions
Programme Overview
Training Description
Digital forensics analysts/specialists
Incident response team members
Cybercrime investigators (government & private
Information security auditors/managers
Professionals benefiting from the certification
Law enforcement & military personnel
Legal professionals
It & network administrators
Ethical hackers (ceh-certified individuals)
Session Objectives
- Perform incident response and forensics Perform electronic evidence collections Perform digital forensic acquisitions Perform bit-stream imaging/acquiring of the digital media seized during the process of investigation. Examine and analyze text, graphics, multimedia, and digital images Conduct thorough examinations of computer hard disk drives, and other electronic data storage media Recover information and electronic data from computer hard drives and other data storage devices Follow strict data and evidence handling procedures Maintain audit trail (i.e., chain of custody) and evidence integrity
About the Course
The computer hacking forensic investigator (chfi) certification is a globally recognized program offered by ec-council. In kenya, this training is provided by several accredited institutions and focuses on equipping professionals with the skills to detect, investigate, and prevent cybercrimes.
Curriculum & Topics
7 Topics | 32 Sessions
-
Workshop 1.1:
This module introduces the fundamentals of computer forensics, its scope, and the role of a forensic investigator. Key topics include:
-
Workshop 1.2:
Types of cybercrimes and investigation procedures.
-
Workshop 1.3:
Understanding digital evidence and the legal principles of eDiscovery.
-
Workshop 1.4:
Concepts of forensic readiness and the Incident Response process.
-
Workshop 1.5:
N/A
-
Workshop 2.1:
This covers the methodological steps of a forensics investigation to ensure evidence integrity and admissibility.
-
Workshop 2.2:
First Response procedures at the crime scene.
-
Workshop 2.3:
Pre-Investigation Phase (setting up a forensics lab, preparation).
-
Workshop 2.4:
Investigation Phase (documenting the scene, search and seizure, chain of custody).
-
Workshop 2.5:
Post-Investigation Phase (reporting and testifying).
-
Workshop 3.1:
This focuses on the technical foundation of where data is stored.
-
Workshop 3.2:
Fundamentals of storage devices (HDD, SSD) and their interfaces.
-
Workshop 3.3:
Disk structures, the boot process (Windows, Linux, macOS).
-
Workshop 3.4:
In-depth analysis of different file systems (FAT, NTFS, Ext, HFS+, APFS).
-
Workshop 3.5:
Storage and encoding standards like RAID.
-
Workshop 4.1:
This module teaches the critical skill of evidence collection, focusing on creating forensically sound copies.
-
Workshop 4.2:
Understanding live (volatile) vs. dead (static) data acquisition.
-
Workshop 4.3:
The Data Acquisition Methodology and its steps.
-
Workshop 4.4:
Use of write blockers to prevent alteration of the original evidence.
-
Workshop 4.5:
Different acquisition formats (Raw, proprietary) and validation techniques.
-
Workshop 5.1:
This module covers methods cybercriminals use to thwart investigations and how a forensic professional can overcome them.
-
Workshop 5.2:
Techniques for data deletion and methods for file carving to recover evidence.
-
Workshop 5.3:
Detection and analysis of steganography (hidden data).
-
Workshop 5.4:
Methods for password cracking/bypassing and dealing with encryption.
-
Workshop 6.1:
Collecting volatile (RAM, cache) and non-volatile data.
-
Workshop 6.2:
Analyzing Windows Registry, system logs, event logs, and browser history.
-
Workshop 6.3:
Examining system-specific artifacts like ShellBags, LNK files, and Jump Lists.
-
Workshop 6.4:
Specific techniques for investigating Linux and macOS environments.
-
Workshop 7.1:
Focuses on capturing, recording, and analyzing network traffic to identify security breaches and attacks.
-
Workshop 7.2:
Network-based evidence and log analysis (Firewall, IDS, VPN, DHCP, DNS).
-
Workshop 7.3:
Event correlation to piece together a timeline of an incident.
-
Workshop 7.4:
Investigating and detecting
