Capability Development / Cyber Security
Computer Hacking Forensic Investigator (CHFI)
This program builds strong practical skills in digital forensic investigation, from evidence acquisition and preservation to analysis and reporting. Learners gain a structured understanding of cybercrime investigation procedures, forensic readiness, and legal compliance across operating system, network, cloud, mobile, and IoT environments. Through hands-on labs and real-world investigation scenarios, participants develop the capability to identify, collect, examine, and document digital evidence in a forensically sound manner.
Program Overview
This program builds strong practical skills in digital forensic investigation, from evidence acquisition and preservation to analysis and reporting. Learners gain a structured understanding of cybercrime investigation procedures, forensic readiness, and legal compliance across operating system, network, cloud, mobile, and IoT environments. Through hands-on labs and real-world investigation scenarios, participants develop the capability to identify, collect, examine, and document digital evidence in a forensically sound manner.
Audience Profile
Digital forensic investigators and analysts; IT security and incident response professionals; Law enforcement and legal compliance personnel; SOC analysts moving into forensic roles; and Basic understanding of operating systems and networks recommended.
Course Syllabus
Module 1: Computer Forensics Foundations & Investigation Process
Topics
- Fundamentals of computer forensics
- Cybercrime investigation procedures
- Digital evidence and eDiscovery
- Forensic readiness
- Roles of a forensic investigator
- Legal compliance and standards
- First response and pre-investigation phase
- Investigation and post-investigation phases
Labs / Practice
- Create a hard disk image file for forensic investigation and recover data
Module 2: Disk Structures, File Systems & Data Acquisition
Topics
- Disk drives and logical structure
- OS booting processes
- Windows, Linux, and Mac file systems
- File system and file format analysis
- Hex editors and encoding standards
- Data acquisition methodology
- eDiscovery and image preparation
Labs / Practice
- Analyze file systems of Linux and Windows evidence images and recover deleted files
- Create a forensic image and convert it into supported acquisition formats
Module 3: Anti-Forensics & Evidence Recovery
Topics
- Anti-forensics techniques
- Data deletion and recycle bin forensics
- File carving and partition recovery
- Password cracking and bypassing
- Steganography and trail obfuscation
- Artifact wiping and metadata detection
- Program packers and footprint minimizing
Labs / Practice
- Perform SSD file carving on Windows and Linux file systems
- Recover lost or deleted partitions and their contents
- Crack passwords of various applications
- Detect hidden data streams and unpack program packers
Module 4: Windows, Linux & Mac Forensics
Topics
- Volatile and non-volatile data collection
- Windows memory and registry analysis
- Electron application and browser forensics
- ShellBags, LNK files, and jump lists
- Windows event log analysis
- Linux and Mac memory forensics
- Mac forensic tools
Labs / Practice
- Acquire and investigate RAM and Windows registry contents
- Examine forensic artifacts from web browsers
- Perform volatile and non-volatile data acquisition on Linux and Mac
Module 5: Network & Malware Forensics
Topics
- Network forensics fundamentals
- Event correlation and indicators of compromise
- Network traffic investigation
- Wireless network attack investigation
- Static and dynamic malware analysis
- Suspicious document analysis
- System and network behavior analysis
- Ransomware analysis
Labs / Practice
- Identify and investigate network attacks
- Perform static malware analysis on suspicious files
- Analyze a suspicious PDF and Office document
Module 6: Web, Dark Web & Cloud Forensics
Topics
- Web application forensics
- IIS and Apache server log analysis
- Web application attack investigation
- Dark web and Tor browser forensics
- AWS, Azure, and GCP fundamentals
- Cloud forensic acquisition and examination
Labs / Practice
- Identify and investigate web application attacks
- Detect Tor browser activity from RAM dumps
- Forensic acquisition of AWS EC2, Azure VM, and GCP VM instances
Module 7: Email, Social Media, Mobile & IoT Forensics
Topics
- Email crime investigation and U.S. law
- Social media forensics
- Mobile device architecture and boot process
- Phone locks, rooting, and jailbreaking
- Logical and physical mobile acquisition
- Android and iOS forensic analysis
- IoT concepts and device forensics
Labs / Practice
- Investigate a suspicious email to extract forensic evidence
- Examine an Android image file and carve deleted files