CHFI Computer Hacking Forensic Investigator

CHFI: Computer Hacking Forensic Investigator
Course ID #: 1275-200-ZZ-W
Hours: 35
Course Content
Course Description:
In this course, you will cover, you will cover all the essentials of digital forensics analysis and
evaluation required for today’s digital world. From identifying the footprints of a breach to collecting
evidence for a prosecution, CHFI v10 walks students through every step of the process with
experiential learning. This course has been tested and approved by veterans and top practitioners of
the cyber forensics industry. CHFI v10 is engineered by industry practitioners for both professionals
and aspiring professionals alike from careers including forensic analysts, cybercrime investigators,
cyber defense forensic analysts, incident responders, information technology auditors, malware
analysts, security consultants, and chief security officers.
Course Objectives:
Upon successful completion of this course, students will be able to:
• Perform effective digital forensic investigation.
Prerequisites:
• IT/Forensics Professionals with basic knowledge on IT/Cyber Security, Computer Forensics, and
Incident response.
• Knowledge of Threat Vectors
• Prior completion of CEH training would be an advantage.
Target Audience:
• Anyone interested in cyber forensics/investigations.
• Attorneys, Legal Consultants, and Lawyers
• Law Enforcement Officers
• Police Officers
• Federal/Government Agents
• Defense and Military
• Detectives/Investigators
• Incident Response Team Members
• Information Security Managers
• Network Defenders
• IT Professionals, IT Directors/Managers
• System/Network Engineers
• Security Analyst/Architect/Auditors/Consultants
www.tcworkshop.com Pages 1 of 24 800.639.3535

Hours: 35
Topics:
Module 01: Computer Forensics in

Lesson 4: Understand Forensic Readiness,
Today’s World Incident Response and the Role of SOC (Security
Operations Center) in Computer Forensics
Lesson 1: Understanding the Fundamentals of • Forensic Readiness
Computer Forensics • Forensic Readiness and Business Continuity
• Understanding Computer Forensics • Forensics Readiness Planning
• Need for Computer Forensics • Incident Response
• Why and When Do You Use Computer • Computer Forensics as a part of Incident
Forensics? Response Plan
• Overview of Incident Response Process Flow
Lesson 2: Understand Cybercrimes and their • Role of SOC in Computer Forensics
Investigation Procedures
• Types of Cybercrimes Lesson 5: Identify the Roles and Responsibilities
o Examples of Cybercrimes of a Forensic Investigator
• Impact of Cybercrimes at the Organizational • Need for a Forensic Investigator
Level • Roles and Responsibilities of a Forensics
• Cybercrime Investigation Investigator
o Civil vs. Criminal Investigation • What Makes a Good Computer Forensics
o Administrative Investigation Investigator?
• Code of Ethics
Lesson 3: Understand Digital Evidence • Accessing Computer Forensics Resources
• Introduction to Digital Evidence
• Types of Digital Evidence Lesson 6: Understand the Challenges Faced in
• Roles of Digital Evidence Investigating Cybercrimes
• Sources of Potential Evidence • Challenges Cybercrimes Pose to Investigators
• Rules of Evidence • Other Factors That Influence Forensic
• Best Evidence Rule Investigations
• Federal Rules of Evidence (United States) • Computer Forensics: Legal Issues
• Scientific Working Group on Digital Evidence • Computer Forensics: Privacy Issues
(SWGDE)
• The Association of Chief Police Officers (ACPO) Lesson 7: Understand Legal Compliance in
Principles of Digital Evidence Computer Forensics
• Computer Forensics and Legal Compliance
• Other Laws Relevant to Computer Forensics

Hours: 35
Module 02: Computer Forensics o Dealing with Networked Computers

o Dealing with Open Files and Startup Files
Investigation Process o Operating System Shutdown Procedure
o Dealing with Smartphones or Other
Lesson 1: Understand the Forensic Investigation Handheld Devices
Process and Its Importance • Evidence Preservation
• Forensic Investigation Process o Preserving Evidence
• Importance of the Forensic Investigation Process o Chain of Custody
o Simple Format of the Chain of Custody
Lesson 2: Understand the Pre-investigation Document
Phase o Chain of Custody Form
• Setting Up a Computer Forensics Lab o Chain of Custody on Property Evidence
• Building the Investigation Team Envelope/Bag and Sign-out Sheet
• Understanding the Hardware and Software o Evidence Bag Contents List
Requirements of a Forensic Lab o Packaging Evidence
• Validating Laboratory Software and Hardware o Exhibit Numbering
• Ensuring Quality Assurance o Determining the Location for Evidence
Examination
Lesson 3: Understand First Response o Transporting and Storing Evidence
• First Response Basics • Data Acquisition
• First Response by Non-forensics Staff o Acquiring the Data
• First Response by System/Network o Duplicating the Data (Imaging)
Administrators • Data Analysis
• First Response by Laboratory Forensics Staff o Analyzing the Data
• Case Analysis
Lesson 4: Understand the Investigation Phase o Analysis of the Case
• Documenting the Electronic Crime Scene o Evidence Reconstruction
o Documenting the Electronic Crime Scene o Collecting Evidence from Social Networks
o Photographing and Sketching the Scene
• Search and Seizure Lesson 5: Understand the Post-investigation
o Search and Seizure Process Flow Phase
o Planning the Search and Seizure • Reporting
o Seeking Consent o Gathering and Organizing Information
o Obtaining Witness Signatures o Writing the Investigation Report
o Obtaining Warrant for Search and Seizure o Forensic Investigation Report Template
o Example of a Search Warrant o Guidelines for Writing a Report
o Searches Without a Warrant • Testify as an Expert Witness
o Collecting Incident Information o Who is an Expert Witness?
o Initial Search of the Scene o Roles of an Expert Witness
o Securing and Evaluating the Crime Scene: A o What Makes a Good Expert Witness?
Checklist o Testifying in the Court
o Seizing Evidence at the Crime Scene o General Ethics while Testifying
o Dealing with Powered-On Computers
o Dealing with Powered-Off Computers
Hours: 35
Module 03: Understanding Hard Disks Lesson 3: Understand Booting Process of

Windows, Linux and Mac Operating Systems
and File Systems • What is the Booting Process?
• Essential Windows System Files
Lesson 1: Describe Different Types of Disk
• Windows Boot Process: BIOS-MBR Method
Drives and their Characteristics o Identifying the MBR Partition
• Understanding Hard Disk Drive • Windows Boot Process: UEFI-GPT
o Tracks o Identifying the GUID Partition Table (GPT)
o Sector o Analyzing the GPT Header and Entries
o 4K Sectors o GPT Artifacts
o Data Density on a Hard Disk • Macintosh Boot Process
o CHS (Cylinder-Head-Sector) Data • Linux Boot Process
Addressing and Disk Capacity Calculation
o Measuring the Hard Disk Performance Lesson 4: Understand Various File Systems of
• Understanding Solid-State Drive (SSD)
Windows, Linux and Mac Operating Systems
• Disk Interfaces
• Windows File Systems
o ATA/PATA (IDE/EIDE)
o File Allocation Table (FAT)
o Serial ATA/ SATA (AHCI)
• FAT File System Layout
o Serial Attached SCSI
• FAT Partition Boot Sector
o PCIe SSD
• FAT Folder Structure
o SCSI
• Directory Entries and Cluster Chains
• Filenames on FAT Volumes
Lesson 2: Explain the Logical Structure of a Disk
• FAT32
• Logical Structure of Disks
o New Technology File System (NTFS)
o Clusters
• NTFS Architecture
o Lost Clusters
• NTFS System Files
o Slack Space
• NTFS Partition Boot Sector
o Master Boot Record (MBR)
• Cluster Sizes of NTFS Volume
o Structure of a Master Boot Record
• NTFS Master File Table (MFT)
o Disk Partitions
o Metadata Files Stored in the MFT
o BIOS Parameter Block (BPB)
• NTFS Attributes
o Globally Unique Identifier (GUID)
• NTFS Data Stream
• GUID Partition Table (GPT)
• NTFS Compressed Files
• Encrypting File Systems (EFS)
o Components of EFS
o EFS Attribute
• Sparse Files
• Linux File Systems
• Linux File System Architecture
o Filesystem Hierarchy Standard (FHS)
o Extended File System (ext)
o Second Extended File System (ext2)
o Third Extended File System (ext3)

Hours: 35
o Journaling File System Lesson 8: Analyze Popular File Formats Using

o Fourth Extended File System (ext4) Hex Editor
o Understanding Superblocks, Inodes, and • Image File Analysis: JPEG
Data Blocks • Image File Analysis: BMP
• Mac OS X File Systems • Hex View of Popular Image File Formats
o Hierarchical File System Plus (HFS+) • PDF File Analysis
• HFS Plus Volumes • Word File Analysis
• HFS Plus Journal • PowerPoint File Analysis
o Apple File System (APFS) • Excel File Analysis
• Major Components of APFS • Hex View of Other Popular File Formats
• APFS vs. HFS Plus • Hex View of Popular Video File Formats
• CD-ROM/DVD File System • Hex View of Popular Audio File Formats
• Virtual File System (VFS) and Universal Disk
Format (UDF) File System
Lesson 5: Examine File System Using Autopsy

and The Sleuth Kit Tools
• File System Analysis Using Autopsy
• File System Analysis Using The Sleuth Kit (TSK)
o The Sleuth Kit (TSK): fsstat
o The Sleuth Kit (TSK): istat
o The Sleuth Kit (TSK): fls and img_stat
Lesson 6: Understand Storage Systems

• RAID Storage System
o Levels of RAID Storage System
o Just a Bunch of Drives/Disks (JBOD)
o Host Protected Areas (HPA) and Device
Configuration Overlays (DCO)
• NAS/SAN Storage
o Network-Attached Storage (NAS)
o Storage Area Network (SAN)
o Differences between NAS and SAN
Lesson 7: Understand Encoding Standards and

Hex Editors
• Character Encoding Standard: ASCII
• Character Encoding Standard: UNICODE
• OFFSET
• Understanding Hex Editors
• Understanding Hexadecimal Notation

Hours: 35
Module 04: Data Acquisition and • Digital Collector

• OSXpmem
Duplication • Step 5: Enable Write Protection on the Evidence
Media
Lesson 1: Understand Data Acquisition • Step 6: Acquire Non-volatile Data
Fundamentals o Using a Windows Forensic Workstation
• Understanding Data Acquisition o Using a Linux Forensic Workstation
• Live Acquisition o Using macOS - Single User Mode
• Order of Volatility o Using macOS - Target Disk Mode
• Dead Acquisition o Using a Linux Bootable CD/USB
• Rules of Thumb for Data Acquisition o Using Digital Collector
• Types of Data Acquisition o Acquiring RAID Disks
o Logical Acquisition • Step 7: Plan for Contingency
o Sparse Acquisition • Step 8: Validate Data Acquisition Using
o Bit-Stream Imaging o Windows Validation Methods
• Bit-stream disk-to-image file o Linux/Mac Validation Methods
• Bit-stream disk-to-disk
• Determine the Data Acquisition Format Lesson 3: Prepare an Image File for Examination
o Raw Format • Preparing an Image for Examination
o Proprietary Format o Scenario 1: The Acquired Evidence is in E01
o Advanced Forensics Format (AFF) Format and the Forensic Workstation is Linux
o Advanced Forensic Framework 4 (AFF4) o Scenario 2: The Acquired Evidence Needs to
be Converted to a Bootable VM
Lesson 2: Understand Data Acquisition o Scenario 3: The Acquired Physical Hard Disk
Methodology Contains Windows File System and the
• Data Acquisition Methodology Forensic Workstation is Linux
• Step 1: Determine the Best Data Acquisition o Scenario 4: The Acquired Evidence Contains
Method APFS file system and the Forensic
• Step 2: Select the Data Acquisition Tool Workstation is Linux
• Step 3: Sanitize the Target Media • Viewing an Image on a Windows, Linux and
• Step 4: Acquire Volatile Data Mac Forensic Workstations
o Acquire Volatile Data from a Windows
Machine
o Acquire Volatile Data from a Linux Machine
• Acquire Volatile Data from a Linux Machine
Using dd (Local Acquisition)
Using dd and Netcat (Remote Acquisition)
Using LiME (Local Acquisition)
Using LiME and Netcat (Remote Acquisition)
o Acquire Volatile Data from a Mac Machine
Using
Hours: 35
Module 05: Defeating Anti-forensics Ophcrack

• Password Cracking: Using Cain & Abel and
Techniques RainbowCrack
• Password Cracking: Using PwDump7
Lesson 1: Understand Anti-forensics Techniques • Password Cracking Tools
• What is Anti-forensics? • Bypassing Passwords on Powered-off Computer
• Anti-forensics Techniques o Bypassing BIOS Passwords
o Bypassing BIOS Passwords by Resetting
Lesson 2: Discuss Data Deletion and Recycle Bin CMOS Using Jumpers
Forensics o Bypassing BIOS Passwords by Removing
• Anti-forensics Technique: Data/File Deletion CMOS Battery
• What Happens When a File is Deleted in • Tool to Reset Admin Password
Windows? o Lazesoft Recover My Password
• Recycle Bin in Windows o Bypassing Windows User Password: Lazesoft
o Recycle Bin Forensics Recovery Suite
o Bypassing Windows User Password by
Lesson 3: Illustrate File Carving Techniques and Booting Live CD/USB
Ways to Recover Evidence from Deleted o Application Password Cracking Tools
Partitions
• File Carving Lesson 5: Detect Steganography, Hidden Data in
o File Carving on Windows File System Structures, Trail Obfuscation, and
• SSD File Carving on Windows File System File Extension Mismatch
• HDD File Carving on Windows File System • Anti-forensics Technique: Steganography
• File Recovery Tools: Windows o Defeating Anti-forensics: Steganalysis
o File Carving on Linux o Steganalysis Methods/Attacks on
• File Carving on Linux File System Steganography
• File Recovery Tools: Linux • Detecting Steganography (Text, Image, Audio,
o File Carving on macOS and Video Files)
• SSD File Carving on Apple File System o Steganography Detection Tools
• File Recovery Tools: macOS • Defeating Anti-forensics Technique: Detecting
• Recovering Deleted Partitions Data Hiding in File System Structures Using
o Recovering Deleted Partitions: Using R- OSForensics
Studio • Anti-forensics Technique: Alternate Data
o Recovering Deleted Partitions: Using EaseUS Streams
Data Recovery Wizard o Defeating Anti-forensics Technique:
o Partition Recovery Tools Detecting Alternate Data Streams
o Defeating Anti-forensics Technique:
Lesson 4: Explore Password Cracking/Bypassing Detecting Alternate Data Streams Using
Techniques Stream Detector
• Anti-forensics Technique: Password Protection • Anti-forensics Technique: Trail Obfuscation
• Using Rainbow Tables to Crack Hashed • Defeating Anti-forensics Technique: Detecting
Passwords File Extension Mismatch Using Autopsy
o Tool to Create Rainbow Tables: Winrtgen
• Password Cracking: Using L0phtCrack and
Hours: 35
Lesson 6: Understand Techniques of Artifact

Wiping, Overwritten Data/Metadata Detection,
and Encryption
• Anti-forensics Technique: Artifact Wiping
• Anti-forensics Technique: Overwriting
Data/Metadata
Detecting Overwritten Data/Metadata
• Anti-forensics Technique: Encryption
o Recover Encrypted Files Using Advanced
EFS Data Recovery Tool
Lesson 7: Detect Program Packers and Footprint

Minimizing Techniques
• Anti-forensics Technique: Program Packers
o Unpacking Program Packers
• Anti-forensics Techniques that Minimize
Footprint
Detecting USB Devices
Lesson 8: Understand Anti-forensics

Countermeasures

Hours: 35
Module 06: Windows Forensics Lesson 2: Perform Windows Memory and

Registry Analysis
Lesson 1: Collect Volatile and Non-volatile • Windows Crash Dump
Information • Collecting Process Memory
• Collecting Volatile Information • Random Access Memory (RAM) Acquisition
o Collecting System Time • Memory Forensics
o Collecting Logged-On Users o Malware Analysis Using Redline
• PsLoggedOn Tool o Malware Analysis Using Volatility
• net sessions Command Framework
• LogonSessions Tool o Virtual Memory Acquisition Using FTK
• Collecting Open Files Imager
• net file Command o Page File
• Using NetworkOpenedFiles • Examining Pagefile Using Strings Command
o Collecting Network Information o Hibernate Files
o Collecting Information about Network • Windows Registry Analysis
Connections o Windows Registry
o Process Information o Registry Structure within a Hive File
o Process-to-Port Mapping o Windows Registry: Forensic Analysis
o Examining Process Memory o The Registry as a Log File
o Collecting Network Status o Collecting System Information
o Examining Print Spool files o Collecting Last Shutdown Time and Time
o Collecting Clipboard Contents and Zone Information
Service/Driver Information o Shares
o Collecting Command History and Locally o Wireless SSIDs
Shared Resource Information o Startup Locations
• Collecting Non-volatile Information o System Boot
o Examining File Systems o Importance of Volume Shadow Copy Services
o ESE Database File o User Login
• Examining .edb File Using ESEDatabaseView o Microsoft Security ID
o Windows Search Index Analysis o User Activity
o Detecting Externally Connected Devices to o Enumerating Autostart Registry Locations
the System o Registry Settings
o Slack Space o USB Removable Storage Devices
o Collecting Hidden Partition Information o Mounted Devices
o Other Non-volatile Information o Tracking User Activity
o Analyzing Windows Thumbnail Cache o The UserAssist Keys
o MRU Lists
o Connecting to Other Systems
o Analyzing Restore Point Registry Settings
o Determining the Startup Locations

Hours: 35
Lesson 3: Examine the Cache, Cookie and History Lesson 5: Understand ShellBags, LNK Files, and
Recorded in Web Browsers Jump Lists
• Cache, Cookie, and History Analysis: Mozilla • Windows ShellBags
Firefox o Windows ShellBags: Forensic Analysis
o Analysis Tool: MZCacheView o Parsing ShellBags: Using ShellBags Explorer
o Analysis Tool: MZCookiesView Tool
o Analysis Tool: MZHistoryView • Analyzing LNK Files
• Cache, Cookie, and History Analysis: Google o Analyzing LNK files: LECmd Tool
Chrome • Analyzing Jump Lists
o Analysis Tool: ChromeCacheView o Analyzing Jump Lists: JumpListExt Tool
o Analysis Tool: ChromeCookiesView
o Analysis Tool: ChromeHistoryView Lesson 6: Understand Text-based Logs and
• Cache, Cookie, and History Analysis: Microsoft Windows Event Logs
Edge • Understanding Events
o Analysis Tool: IECacheView • Types of Logon Events
o Analysis Tool: EdgeCookiesView • Event Log File Format
o Analysis Tool: BrowsingHistoryView • Organization of Event Records
• ELF_LOGFILE_HEADER Structure
Lesson 4: Examine Windows Files and Metadata • EventLogRecord Structure
• Windows File Analysis • Windows 10 Event Logs
o System Restore Points (Rp.log Files) • Evaluating Account Management Events
o System Restore Points (Change.log.x Files) • Event Logs
o Prefetch Files o Examining System Log Entries
• Examining Prefetch Files Using o Examining Application Log Entries
WinPrefetchView o Searching with Event Viewer
o Image Files o Using Event Log Explorer to Examine Log
o Understanding EXIF Data Files
• Metadata Investigation o Windows Event Log Files Internals
o Understanding Metadata o Examining Removable Storage Using Event
o Metadata in Different File Systems Viewer
o Metadata in PDF Files • Windows Forensics Tools
o Metadata in Word Documents o OSForensics
o Metadata Analysis Tool: Metashield Analyzer o Kroll Artifact Parser and Extractor (KAPE)
• Hashing it Out in PowerShell: Using Get-
FileHash

Hours: 35
Module 07: Linux and Mac Forensics Lesson 3: Demonstrate Memory Forensics Using
Volatility & PhotoRec
Lesson 1: Understand Volatile and Non-volatile • Memory Forensics
Data in Linux o Introduction
• Introduction to Linux Forensics o Collecting Network Information
• Collecting Volatile Data o Listing Open Files
o Collecting Hostname, Date, and Time o Collecting Bash Information
o Collecting Uptime Data o Collecting System Information
o Collecting Network Information o Collecting Kernel Memory Information
o Viewing Network Routing Tables o Malware Analysis Using Volatility
o Collecting Open Port Information Framework
o Finding Programs/Processes Associated with o Carving Memory Dumps Using PhotoRec
a Port Tool
o Collecting Data on Open Files
o Collecting Mounted File System Information Lesson 4: Understand Mac Forensics
o Finding Loaded Kernel Modules • Introduction to Mac Forensics
o Collecting User Events and Reading ELF Files • Mac Forensics Data
o Viewing Running Processes in the System • Mac Log Files
o Collecting Swap Areas and Disk Partition • Mac Directories
Information • APFS Analysis: Biskus APFS Capture
o Collecting Kernel Messages • Parsing Metadata on Spotlight
• Collecting Non-volatile Data • Mac Forensics Tools
o Collecting System Information
o Collecting Kernel Information
o Collecting User Account Information
o Collecting Currently Logged-in Users and
Login History Information
o Collecting System Logs Data
o Linux Log Files
o Collecting User History File Information and
Viewing Hidden Files and Directories
o Collecting Suspicious Information
o File Signature Analysis
o Usage of File and Strings Command
o Using find Command to Find Writable Files
Lesson 2: Analyze Filesystem Images Using The

Sleuth Kit
• File System Analysis Using The Sleuth Kit
o fsstat
o fls
o istat

Hours: 35
Module 08: Network Forensics Lesson 4: Identify Indicators of Compromise

(IoCs) from Network Logs
Lesson 1: Understand Network Forensics • Analyzing Firewall Logs
• Introduction to Network Forensics o Analyzing Firewall Logs: Cisco
• Postmortem and Real-Time Analysis o Analyzing Firewall Logs: Check Point
• Network Attacks • Analyzing IDS Logs
• Indicators of Compromise (IOCs) o Analyzing IDS Logs: Juniper
• Where to Look for Evidence o Analyzing IDS Logs: Check Point
• Types of Network-based Evidence • Analyzing Honeypot Logs
• Analyzing Router Logs
Lesson 2: Explain Logging Fundamentals and o Analyzing Router Logs: Cisco
Network Forensic Readiness o Analyzing Router Logs: Juniper
• Log Files as Evidence • Analyzing DHCP Logs
• Legal Criteria for Admissibility of Logs as
Evidence Lesson 5: Investigate Network Traffic
• Records of Regularly Conducted Activity as • Why Investigate Network Traffic?
Evidence • Gathering Evidence via Sniffers
• Guidelines to Ensure Log File Credibility and • Sniffing Tool: Tcpdump
Usability • Sniffing Tool: Wireshark
• Ensure Log File Authenticity o Display Filters in Wireshark
• Maintain Log File Integrity • Analyze Traffic for TCP SYN Flood DoS Attack
• Implement Centralized Log Management • Analyze Traffic for SYN-FIN Flood DoS Attack
o Centralized Logging Best Practices • Analyze Traffic for FTP Password Cracking
o Centralized Log Management Challenges Attempts
o Addressing the Challenges in Centralized • Analyze Traffic for SMB Password Cracking
Log Management Attempts
• Analyze Traffic for Sniffing Attempts
Lesson 3: Summarize Event Correlation Concepts o Analyze Traffic for MAC Flooding Attempt
• ▪ Event Correlation o Analyze Traffic for ARP Poisoning Attempt
• ▪ Types of Event Correlation • Analyze Traffic to Detect Malware Activity
• ▪ Prerequisites of Event Correlation
• ▪ Event Correlation Approaches

Hours: 35
Lesson 6: Perform Incident Detection and

Examination with SIEM Tools
• Centralized Logging Using SIEM Solutions
• SIEM Solutions: Splunk Enterprise Security (ES)
• SIEM Solutions: IBM QRadar
• Examine Brute-force Attacks
• Examine DoS Attack
• Examine Malware Activity
• Examine Data Exfiltration Attempts over FTP
• Examine Network Scanning Attempts
• Examine Ransomware Attack
• Detect Rogue DNS Server (DNS Hijacking/DNS
Spoofing)
Lesson 7: Monitor and Detect Wireless Network

Attacks
• Wireless Network Security Vulnerabilities
• Monitoring for Attacks and Vulnerabilities
• Detect Rogue Access Points
• Detect Access Point MAC Address Spoofing
Attempts
• Detect Misconfigured Access Points
• Detect Honeypot Access Points
• Detect Signal Jamming Attack

Hours: 35
Module 09: Investigating Web Lesson 6: Investigate Web Attacks on Windows-

based Servers
Application Forensics • Investigating Web Attacks on Windows-based
Servers
Lesson 1: Understand Web Application Forensics
• Introduction to Web Application Forensics
Lesson 7: Detect and Investigate Various Attacks
• Challenges in Web Application Forensics
on Web Applications
• Indications of a Web Attack
• Investigating Cross-Site Scripting (XSS) Attack
• Web Application Threats
o Investigating XSS: Using Regex to Search XSS
• Web Attack Investigation Methodology
Strings
o Examining Apache Logs for XSS Attack
Lesson 2: Understand Internet Information
o Examining IIS Logs for XSS Attack
Services (IIS) Logs
o Examining Snort Alert Logs for XSS Attack
• IIS Web Server Architecture
o Examining WAF Logs for XSS Attack
• IIS Logs
o Examining SIEM Logs for XSS Attack
• Analyzing IIS Logs
• Investigating SQL Injection Attack
o Investigating SQL Injection Attack: Using
Lesson 3: Understand Apache Web Server Logs
Regex
• Apache Web Server Architecture
o Examining Apache Logs for SQL Injection
• Apache Web Server Logs
Attack
• Apache Access Logs
o Examining IIS Logs for SQL Injection Attack
o Analyzing Apache Access Logs
o Examining Snort Alert Logs for SQL Injection
• Apache Error Logs
Attack
o Analyzing Apache Error Logs
o Examining WAF Logs for SQL Injection
Attack
Lesson 4: Understand the Functionality of
o Examining SIEM Logs for SQL Injection
Intrusion Detection System (IDS)
Attack
• Intrusion Detection System (IDS)
• Investigating Path/Directory Traversal Attack
• How IDS Detects an Intrusion
o Examining Apache Logs for Path/Directory
• Intrusion Detection Tool: Snort
Traversal Attack
• Snort Rules
• Investigating Command Injection Attack
o Examining Apache Logs for Command
Lesson 5: Understand the Functionality of Web
Injection Attack
Application Firewall (WAF)
• Investigating XML External Entity (XXE) Attack
• Web Application Firewall (WAF)
o Examining Apache Log File for XXE Attack
• Benefits of WAF
• Investigating Brute-force Attack
• Limitations of WAF
o Examining Apache Log File for Brute-force
• WAF Tool: ModSecurity
Attack
• Types of ModSecurity Data Formats
o Analyzing ModSecurity Alerts
o Analyzing ModSecurity Audit Logs

Hours: 35
Module 10: Dark Web Forensics

Lesson 1: Understand the Dark Web
• Understanding the Dark Web
• Tor Relays
• Working of the Tor Browser
• Tor Bridge Node
Lesson 2: Determine How to Identify the Traces

of Tor Browser during Investigation
• Dark Web Forensics
• Identifying Tor Browser Artifacts: Command
Prompt
• Identifying Tor Browser Artifacts: Windows
Registry
• Identifying Tor Browser Artifacts: Prefetch Files
Lesson 3: Perform Tor Browser Forensics

• Tor Browser Forensics: Memory Acquisition
• Collecting Memory Dumps
• Memory Dump Analysis: Bulk Extractor
• Forensic Analysis of Memory Dumps to
Examine Email Artifacts (Tor Browser Open)
• Forensic Analysis of Storage to Acquire Email
Attachments (Tor Browser Open)
• Forensic Analysis of Memory Dumps to
Examine Email Artifacts (Tor Browser Closed)
• Forensic Analysis of Storage to Acquire Email
Attachments (Tor Browser Closed)
• Forensic Analysis: Tor Browser Uninstalled
• Dark Web Forensics Challenges

Hours: 35
Module 11: Database Forensics Lesson 7: Perform MySQL Forensics on

WordPress Web Application Database
Lesson 1: Understand Database Forensics and its • Common Scenario for Reference
Importance • MySQL Forensics for WordPress Website
▪ Database Forensics and its Importance Database: Scenario 1
o Collect the Evidence
o Examine the Log Files
Lesson 2: Determine Data Storage and Database
o Analyze the General Log
Evidence Repositories in MSSQL Server
o Take Backup of the Database
• Data Storage in SQL Server
o Create Evidence Database
• Database Evidence Repositories
o Select Database
o View Tables in the Database
Lesson 3: Collect Evidence Files on MSSQL Server
o View Users in the Database
• Collecting Volatile Database Data
o View Columns in the Table
• Collecting Primary Data File and Active
o Collect Posts Made by the User
Transaction Logs Using SQLCMD
o Examine the Posts Made by the User
• Collecting Primary Data File and Transaction
• MySQL Forensics for WordPress Website
Logs
Database: Scenario 2
• Collecting Active Transaction Logs Using SQL
o Collect the Database and All the Logs
Server Management Studio
o Examine the Binary Logs
• Collecting Database Plan Cache
o wp_users.ibd in WordPress Database
• Collecting Windows Logs
o wp_posts.ibd in WordPress Database
• Collecting SQL Server Trace Files
• Collecting SQL Server Error Logs
Lesson 4: Perform MSSQL Forensics

• Database Forensics Using SQL Server
Management Studio
• Database Forensics Using ApexSQL DBA
Lesson 5: Understand Internal Architecture of

MySQL and Structure of Data Directory
• Internal Architecture of MySQL
• Structure of Data Directory
Lesson 6: Understand Information Schema and

List MySQL Utilities for Performing Forensic
Analysis
• MySQL Forensics
• Viewing the Information Schema
• MySQL Utility Programs for Forensic Analysis

Hours: 35
Module 12: Cloud Forensics Lesson 4: Determine How to Investigate Security

Incidents in AWS
Lesson 1: Understand the Basic Cloud • Forensic Acquisition of Amazon EC2 Instance:
Computing Concepts Methodology
• Introduction to Cloud Computing o Step 1: Isolate the Compromised EC2 Instance
• Types of Cloud Computing Services o Step 2: Take a Snapshot of the EC2 Instance
• Cloud Deployment Models o Step 3: Provision and Launch a Forensic
• Cloud Computing Threats Workstation
• Cloud Computing Attacks o Step 4: Create Evidence Volume from the
Snapshot
Lesson 2: Understand Cloud Forensics o Step 5: Attach the Evidence Volume to the
• Introduction to Cloud Forensics Forensic Workstation
• Usage of Cloud Forensics o Step 6: Mount the Evidence Volume on the
• Cloud Crimes Forensic Workstation
• Cloud Forensics: Stakeholders and their Roles • Investigating Log Files: CloudWatch Logs and
• Cloud Forensics Challenges S3 Server Access Logs
o Architecture and Identification
o Data Collection Lesson 5: Understand the Fundamentals of
o Logs Microsoft Azure
o Legal • Introduction to Microsoft Azure
o Analysis • Division of Responsibilities in Azure
• Data Storage in Azure
Lesson 3: Understand the Fundamentals of • Logs in Azure
Amazon Web Services (AWS)
• Introduction to Amazon Web Services Lesson 6: Determine How to Investigate Security
• Division of Responsibilities in AWS Incidents in Azure
o Shared Responsibility Model for • Forensic Acquisition of VMs in Azure:
Infrastructure Services Methodology
o Shared Responsibility Model for Container o Forensic Acquisition of VMs in Azure: The
Services Scenario
o Shared Responsibility Model for Abstracted o Step 1: Create a Snapshot of the OS Disk of
Services the Affected VM via Azure Portal and Azure
• Data Storage in AWS CLI
• Logs in AWS o Step 2: Copy the Snapshot to a Storage
Account under a Different Resource Group
o Step 3: Delete the Snapshot from the Source
Resource Group and Create a Backup Copy
o Step 4: Mount the Snapshot onto the Forensic
Workstation
o Analyze the Snapshot via Autopsy

Hours: 35
Lesson 7: Understand Forensic Methodologies

for Containers and Microservices
• What are Containers and Microservices?
• Challenges of Performing Forensics on
Containers
• Container Forensics and Incident Response:
Methodology
• Container Forensics Using Docker

Hours: 35
Module 13: Investigating Email • Investigating a Suspicious Email

o Step 6: Recovering Deleted Email Messages
Crimes • Recovering Deleted Email Messages from
Outlook .pst Files Using Paraben’s Electronic
Lesson 1: Understand Email Basics Evidence Examiner
• Introduction to an Email System • Recovering deleted Email Data from
• Components Involved in Email Communication Thunderbird Using Paraben’s Electronic
• How Email Communication Works? Evidence Examiner
• Understanding the Parts of an Email Message
Lesson 3: U.S. Laws Against Email Crime
Lesson 2: Understand Email Crime Investigation ▪ U.S. Laws Against Email Crime: CAN-SPAM Act
and its Steps
• Introduction to Email Crime Investigation
• Steps to Investigate Email Crimes
o Step 1: Seizing the Computer and Email
Accounts
o Step 2: Acquiring the Email Data
• Acquiring Email Data from Desktop-based
Email Clients
o Local Email Files in Microsoft Outlook
o Local Email Files in Mozilla Thunderbird
o Acquiring Thunderbird Local Email Files via
SysTools MailPro+
o Acquiring Outlook Email Files: .ost to .pst
File Conversion
o Acquiring Outlook .pst File via SysTools
MailPro+
• Acquiring Email Data from Web-based Email
Accounts
o Step 3: Examining Email Messages
o Step 4: Retrieving Email Headers
• Retrieving Email Headers in Microsoft Outlook
• Retrieving Email Headers in Microsoft
Outlook.com
• Retrieving Email Headers in AOL
• Retrieving Email Headers in Apple Mail
• Retrieving Email Headers in Gmail
• Retrieving Email Headers in Yahoo Mail
o Step 5: Analyzing Email Headers
• Analyzing Email Headers: X-Headers
• Analyzing Email Headers: Checking Email
Authenticity
• Analyzing Email Headers: Examining the
Originating IP Address
Hours: 35
Module 14: Malware Forensics Lesson 3: Understand and Perform Static

Analysis of Malware
Lesson 1: Define Malware and Identify the • Malware Analysis: Static
Common Techniques Attackers Use to Spread o Static Malware Analysis: File Fingerprinting
Malware o Static Malware Analysis: Online Malware
• Introduction to Malware Scanning
• Components of Malware o Online Malware Analysis Services
• Common Techniques Attackers Use to o Static Malware Analysis: Performing Strings
Distribute Malware across Web Search
o Static Malware Analysis: Identifying
Lesson 2: Understand Malware Forensics Packing/Obfuscation Methods
Fundamentals and Recognize Types of Malware o Static Malware Analysis: Finding the Portable
Executables (PE) Information
Analysis
• Analyzing Portable Executable File Using
• Introduction to Malware Forensics
Pestudio
• Why Analyze Malware?
o Static Malware Analysis: Identifying File
• Malware Analysis Challenges
Dependencies
• Identifying and Extracting Malware
o Static Malware Analysis: Malware
• Prominence of Setting Up a Controlled Malware
Disassembly
Analysis Lab
o Malware Analysis Tool: IDA Pro
• Preparing Testbed for Malware Analysis
• Supporting Tools for Malware Analysis
Lesson 4: Analyze Suspicious Word and PDF
• General Rules for Malware Analysis
• Documentation Before Analysis Documents
• Types of Malware Analysis • Analyzing Suspicious MS Office Document
• Analyzing Suspicious PDF Document
Lesson 5: Understand Dynamic Malware Analysis

Fundamentals and Approaches
• Malware Analysis: Dynamic
o Dynamic Malware Analysis: Pre-Execution
Preparation
o Monitoring Host Integrity
o Monitoring Host Integrity Using
WhatChanged Portable
o Observing Runtime Behavior

Hours: 35
Lesson 6: Analyze Malware Behavior on System Lesson 8: Describe Fileless Malware Attacks and
Properties in Real-time How they Happen
• System Behavior Analysis: Monitoring Registry • Introduction to Fileless Malware
Artifacts • Infection Chain of Fileless Malware
o Windows AutoStart Registry Keys • How Fileless Attack Works via Memory Exploits
o Analyzing Windows AutoStart Registry Keys • How Fileless Attack Happens via Websites
• System Behavior Analysis: Monitoring Processes • How Fileless Attack Happens via Documents
• System Behavior Analysis: Monitoring
Windows Services Lesson 9: Perform Fileless Malware Analysis -
• System Behavior Analysis: Monitoring Startup Emotet
Programs • Fileless Malware Analysis: Emotet
o Startup Programs Monitoring Tool: • Emotet Malware Analysis
AutoRuns for Windows • Emotet Malware Analysis: Timeline of the
• System Behavior Analysis: Monitoring Infection Chain
Windows Event Logs
o Key Event IDs to Monitor
o Examining Windows Event logs
• System Behavior Analysis: Monitoring API Calls
• System Behavior Analysis: Monitoring Device
Drivers
o Device Drivers Monitoring Tool: DriverView
• System Behavior Analysis: Monitoring Files and
Folders
o File and Folder Monitoring Tool: PA File
Sight
o File and Folder Integrity Checkers: FastSum
and WinMD5
Lesson 7: Analyze Malware Behavior on Network

in Real-time
• Network Behavior Analysis: Monitoring
Network Activities
o Monitoring IP Addresses
• Network Behavior Analysis: Monitoring Port
o Examining Open Ports
o Port Monitoring Tools: TCPView and
CurrPorts
• Network Behavior Analysis: Monitoring DNS
o Examining DNS Entries
o DNS Monitoring Tool: DNSQuerySniffer

Hours: 35
Module 15: Mobile Forensics Lesson 5: Understand SIM File System and its
Data Acquisition Method
Lesson 1: Understand the Importance of Mobile • Subscriber Identity Module (SIM)
Device Forensics o SIM File System
• Mobile Device Forensics o Data Stored in a SIM
• Why Mobile Forensics? o Integrated Circuit Card Identification (ICCID)
• Top Threats Targeting Mobile Devices o International Mobile Equipment Identifier
• Mobile Hardware and Forensics (IMEI)
• Mobile OS and Forensics o SIM Cloning
o SIM Data Acquisition Using Oxygen Forensic
Lesson 2: Illustrate Architectural Layers and Boot Extractor
Processes of Android and iOS Devices o SIM Data Acquisition Tools
• Architectural Layers of Mobile Device
Environment Lesson 6: Illustrate Phone Locks and Discuss
• Android Architecture Stack Rooting of Android and Jailbreaking of iOS
• Android Boot Process Devices
• iOS Architecture o Phone Locking on Android
• iOS Boot Process o Phone Locking on iOS
o Normal and DFU Mode Booting o Rooting of Android Devices
o Booting iPhone in DFU Mode o Jailbreaking of iOS Devices
o Booting iPhone in Recovery Mode o Risks of Jailbreaking
o Types of Jailbreaks
Lesson 3: Explain the Steps Involved in Mobile o Semi-tethered Jailbreaking Using Checkra1n
Forensics Process
Lesson 7: Perform Logical Acquisition on
• Mobile Forensics Process
o Collect the Evidence Android and iOS Devices
o Document the Evidence • Logical Acquisition
o Preserve the Evidence o Android Debug Bridge (ADB)
o Mobile Storage and Evidence Locations o Steps Involved in Android Forensics Process
o Data Acquisition Methods o Logical Acquisition of Android Devices:
Using “adb pull” Command
Lesson 4: Investigate Cellular Network Data o Logical Acquisition of Android Devices:
• Components of Cellular Network Using Commercial Tools
• Different Cellular Networks o Logical Acquisition Tools
• Cell Site Analysis: Analyzing Service Provider o Steps Involved in iOS Forensics Process
Data o Logical Acquisition of iOS Devices: Using
• CDR Contents iTunes Backup
o Logical Acquisition of iOS Devices: Using
Commercial Tools
• Cloud Data Acquisition on Android and iOS
Devices
• Cloud Data Acquisition: Using Commercial
Tools

Hours: 35
Lesson 8: Perform Physical Acquisition on

Android and iOS Devices
• Physical Acquisition
o Physical Acquisition of Android Devices:
Using DD Command
Using ADB, Busybox, Netcat
Using Commercial Tools
o Android Forensic Analysis: Using
Commercial Tools
o Physical Acquisition of iOS Devices: Using
SSH, Netcat
o Physical Acquisition of iOS Devices: Using
Commercial Tools
o iOS Forensic Analysis: Using Commercial
Tools
• SQLite Database Extraction
o SQLite Database Browsing Tools: Oxygen
Forensics SQLite Viewer
o SQLite Database Browsing Tools
• JTAG Forensics
• Chip-off Forensics
o Chip-off Forensics Process
o Chip-off Forensic Equipment
• Flasher Boxes
Lesson 9: Discuss Mobile Forensics Challenges

and Prepare Investigation Report
• Challenges in Mobile Forensics
• Generate Investigation Report
• Mobile Forensics Report Template
• Sample Mobile Forensic Analysis Worksheet
• Cellebrite UFED Touch Sample Mobile
Forensics Report Snapshot

Hours: 35
Module 16: IoT Forensics Lesson 4: Perform Forensics on IoT Devices

• Wearable IoT Device: Smartwatch
Lesson 1: Understand IoT and IoT Security o Wearable IoT Device Forensics: Smartwatch
Problems o Steps Involved in Data Acquisition and
• What is IoT? Analysis of Android Wear
• IoT Architecture o Logical Acquisition of Android Wear
• IoT Security Problems o Physical Acquisition of Android Wear
• OWASP Top 10 IoT Vulnerabilities o Forensic Examination of Evidence File:
• IoT Attack Surface Areas Android Wear
o Recovered Forensic Artifacts: Android Wear
Lesson 2: Recognize Different Types of IoT • IoT Device Forensics: Smart Speaker—Amazon
Threats Echo
• IoT Threats o Amazon Alexa Forensics: Client-based
• DDoS Attack Analysis
o Attack on HVAC Systems o Amazon Alexa Forensics: Cloud-based
o Rolling Code Attack Analysis
o BlueBorne Attack o List of Amazon Alexa APIs
o Jamming Attack • Hardware Level Analysis: JTAG and Chip-off
o Hacking Smart Grid/Industrial Devices: Forensics
Remote Access Using Backdoor
o Other IoT Attacks
Lesson 3: Understand IoT Forensics

• Introduction to IoT Forensics
• IoT Forensics Process
• Case Study: Default Passwords Aid Satori IoT
Botnet Attacks
• IoT Forensics Challenges
Register for this class by visiting us at:

www.tcworkshop.com or calling us at 800-639-3535

CHFI Computer Hacking Forensic Investigator

Uploaded by

Copyright:

Available Formats

You might also like

CHFI Computer Hacking Forensic Investigator

Uploaded by

Document Information

Original Description:

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

CHFI Computer Hacking Forensic Investigator

Uploaded by

Copyright:

Available Formats

CHFI: Computer Hacking Forensic Investigator

www.tcworkshop.com Pages 1 of 24 800.639.3535

Module 01: Computer Forensics in

www.tcworkshop.com Pages 2 of 24 800.639.3535

Module 02: Computer Forensics o Dealing with Networked Computers

Module 03: Understanding Hard Disks Lesson 3: Understand Booting Process of

www.tcworkshop.com Pages 4 of 24 800.639.3535

o Journaling File System Lesson 8: Analyze Popular File Formats Using

Lesson 5: Examine File System Using Autopsy

Lesson 6: Understand Storage Systems

Lesson 7: Understand Encoding Standards and

www.tcworkshop.com Pages 5 of 24 800.639.3535

Module 04: Data Acquisition and • Digital Collector

Module 05: Defeating Anti-forensics Ophcrack

Lesson 6: Understand Techniques of Artifact

Lesson 7: Detect Program Packers and Footprint

Lesson 8: Understand Anti-forensics

www.tcworkshop.com Pages 8 of 24 800.639.3535

Module 06: Windows Forensics Lesson 2: Perform Windows Memory and

www.tcworkshop.com Pages 9 of 24 800.639.3535

www.tcworkshop.com Pages 10 of 24 800.639.3535

Lesson 2: Analyze Filesystem Images Using The

www.tcworkshop.com Pages 11 of 24 800.639.3535

Module 08: Network Forensics Lesson 4: Identify Indicators of Compromise

www.tcworkshop.com Pages 12 of 24 800.639.3535

Lesson 6: Perform Incident Detection and

Lesson 7: Monitor and Detect Wireless Network

www.tcworkshop.com Pages 13 of 24 800.639.3535

Module 09: Investigating Web Lesson 6: Investigate Web Attacks on Windows-

www.tcworkshop.com Pages 14 of 24 800.639.3535

Module 10: Dark Web Forensics

Lesson 2: Determine How to Identify the Traces

Lesson 3: Perform Tor Browser Forensics

www.tcworkshop.com Pages 15 of 24 800.639.3535

Module 11: Database Forensics Lesson 7: Perform MySQL Forensics on

Lesson 4: Perform MSSQL Forensics

Lesson 5: Understand Internal Architecture of

Lesson 6: Understand Information Schema and

www.tcworkshop.com Pages 16 of 24 800.639.3535

Module 12: Cloud Forensics Lesson 4: Determine How to Investigate Security

www.tcworkshop.com Pages 17 of 24 800.639.3535

Lesson 7: Understand Forensic Methodologies

www.tcworkshop.com Pages 18 of 24 800.639.3535

Module 13: Investigating Email • Investigating a Suspicious Email

Module 14: Malware Forensics Lesson 3: Understand and Perform Static

Lesson 5: Understand Dynamic Malware Analysis

www.tcworkshop.com Pages 20 of 24 800.639.3535

Lesson 7: Analyze Malware Behavior on Network

www.tcworkshop.com Pages 21 of 24 800.639.3535

www.tcworkshop.com Pages 22 of 24 800.639.3535

Lesson 8: Perform Physical Acquisition on

Lesson 9: Discuss Mobile Forensics Challenges

www.tcworkshop.com Pages 23 of 24 800.639.3535

Module 16: IoT Forensics Lesson 4: Perform Forensics on IoT Devices

Lesson 3: Understand IoT Forensics

Register for this class by visiting us at:

www.tcworkshop.com Pages 24 of 24 800.639.3535

You might also like