3. Bundle: Computer Forensics: Investigating Data and Image Files (CHFI), (2nd Edition)

Finally, this book is a creation of the EC-Council and costs $207 on Amazon. It is a comprehensive bundle that covers everything you need to know to succeed in the EC-Council 312-49 exam. By referring to such material, building a career in computer forensics will appear easier from the moment you get it. So, get your copy of such a book and prepare for your forthcoming CHFI exam like a pro.

Exam Info

EC-Council 312-49 contains 150 questions and the time allotted for their completion is 4 hours. The questions are presented in the multiple-choice format and the applicants must achieve the passing score that ranges from 60% to 85%. The specific score depends on the exam form that a candidate takes. The topics that are covered in the test are enumerated as follows:

• Forensic Science: 15%

  This section measures the candidates’ understanding of various kinds of cybercrimes. It also focuses on the ability to identify different forensic investigation concerns that are available. You should also demonstrate your understanding of the fundamentals of computer forensics and be able to establish the responsibilities and roles associated with the forensic investigators. This topic also covers the skills in understanding the rules and concepts of data acquisition as well as understanding of the fundamental concepts and the ways of working with Cloud computing, databases, malware, dark web, IoT, and emails.

• Regulations, Ethics, and Policies: 10%

  This subject area focuses on one’s understanding of the rules & regulations associated with the search & seizure of evidence. It also focuses on your knowledge of various laws & legal concerns that affect forensic investigations.

• Digital Forensics: 17%

  This objective focuses on the examinees’ skills in reviewing different anti-forensic methods and ways to overcome them. It also focuses on their competence in analyzing different files associated with Linux, Android, and Windows devices as well as analyzing different logs and carrying out network forensics for investigating network attacks. The potential candidates should also be ready to demonstrate their skills in analyzing different logs and carrying out application forensics to evaluate diverse web-based attacks. It also requires their expertise in carrying out forensics on the dark web, Cloud, IoT devices, emails, and databases. They also need the competence to carry out dynamics and static malware analysis within the sandboxed environment. Besides that, these individuals need the skills in analyzing malware behavior on network and system levels as well as analyzing fileless malware.

• Procedures & Methodology: 20%

  Here, you need to demonstrate your understanding of the forensic investigation process and methodology to use in collecting data from various evidence types. This part also covers the skills in illustrating evidence/image examination & event correlation as well as competence in describing malware and dark web forensics.

• Digital Evidence: 20%

  This domain covers the students’ ability to demonstrate their understanding of the fundamental attributes and digital evidence types as well as working and fundamental concepts of mobile and desktop operating systems. Additionally, they should be able to demonstrate their competence in various log types and their significance within forensic investigations. The applicants also need an understanding of different encoding standards and evaluating different types of files.

• Tools, Programs, and Systems: 16%

  If you want to deal with this module of the exam successfully, you should demonstrate the capability to establish different tools for investigating operating systems, which include Mac, Linux, Windows, iOS, and Android. It also requires your competence in determining different tools required to investigate MySQL, AWS, MSSQL, Azure, IoT Devices, and emails.

Reference: https://www.eccouncil.org/programs/computer-hacking-forensic-investigator-chfi/