Every crime leaves a trail of evidence

TM

C HFI
Computer Hacking Forensic
INVESTIGATOR

SECURING
NETWORKS WITH
FORENSIC
SCIENCE
Computer Hacking Forensic Investigator v9
CHFI v9 01
@2017 EC-Council. All Rights Reserved. | CHFI 01/17 | www.eccouncil.org
 INTRODUCING CHFI V9:
WORLD’S MOST COMPREHENSIVE
COMPUTER FORENSIC
CERTIFICATION PROGRAM

Digital technologies are changing the face of Over the last many years, EC-Council’s CHFI
business. As organizations rapidly embracing certification has gained massive traction
digital technologies such as cloud, mobile, big and recognition amongst Fortune 500
data and IOT, the context of digital forensics enterprises globally. It has immensely benefited
is more relevant than before. The growing professionals from law enforcement, criminal
number of cybercrimes has changed the role of investigation, defense, and security field. CHFI
forensics from DNA to Digital. v9, the latest version of the program has been
designed for professionals handling digital
According to the market research report evidence while investigating cybercrimes. It is
published by IndustryARC, by 2020, the digital developed by an experienced panel of subject
forensics market will reach 4.8 billion USD. matter experts and industry specialists, and
IndustryARC also predicts that the maximum also has set global standards for computer
use of digital forensics is from the federal forensics best practices. In addition, it also aims
sector and this will grow from $1,097.2 million at elevating the knowledge, understanding, and
in 2015 to $2,060.5 million by 2020. The major skill levels of in cyber security and forensics
drivers for this are increasing threats from practitioners.
cybercrime and terrorist attacks. Foote Partners,
which tracks information technology (IT)
jobs across all skill levels, projects the global
demand for cyber security talent to rise to six
million by 2019, with an expected shortfall of
1.5 million professionals.

CHFI v9 02
 ABOUT CHFI v9

CHFI v9 covers detailed methodological knowledge level of law enforcement personnel,

approach to computer forensic and evidence system administrators, security officers, defense
analysis. It provides the necessary skillset and military personnel, legal professionals,
for identification of intruder’s footprints and bankers, computer and network security
gathering necessary evidence for its prosecution. professionals, and anyone who is concerned
All major tools and theories used by cyber about the integrity of the network and digital
forensic industry are covered in the curriculum. investigations.
The certification can fortify the applied

It is a comprehensive course covering major

forensic investigation scenarios that enables
CHFI provides necessary skills to students to acquire necessary hands-on experience
perform effective digital forensic on various forensic investigation techniques and
investigation standard forensic tools necessary to successfully
carryout computer forensic investigation leading to
prosecution of perpetrators

CHFI presents a methodological approach to

computer forensic including searching and seizing,
chain-of-custody, acquisition, preservation, analysis
and reporting of digital evidence

CHFI v9 03
 COURSEWARE
DETAILS

COURSE DETAILS EXAM DETAILS

Course Title: Computer Hacking Forensic Investigator (CHFI) v9 • Number of Questions: 150
Duration: 40 hours (5 days, 9:00AM – 5:00PM) • Passing Score: Please refer https://cert.
eccouncil.org/faq.html
Class Format:
• Test Duration: 4 hours
• Instructor-led classroom – Authorized Training Center (ATC) • Test Format: MCQ
• Live online training – iClass • Test Delivery: ECC exam portal

PREREQUISITES WHAT’S NEW IN CHFI V9

• IT/forensics professionals with basic knowledge on IT/cyber security, • 14 comprehensive modules and 39
computer forensics, and incident response labs
• Prior completion of CEH training would be an advantage • More than 40 percent of new labs
• More than 400 new/updated tools
• Classroom friendly curriculum with
WHO SHOULD ATTEND diagrammatic representation of
concepts and examples
• Anyone interested in cyber • Incident response team • New and rich presentation style
forensics/investigations members with eye catching graphics
• Attorneys, legal consultants, and • Information security managers • Coverage of latest operating
lawyers systems
• Network defenders
• Law enforcement officers
• Updated patch management and
• IT professionals, IT directors/ testing environment
• Police officers managers
• Well tested, result oriented,
• Federal/ government agents • System/network engineers descriptive and analytical lab
• Defense and military • Security analyst/ architect/ manual to evaluate the presented
auditors/ consultants concepts
• Detectives/ investigators

CHFI v9 04
 COURSE OUTLINE

CHFI v9 curriculum is a comprehensive course with 14 training modules covering major forensic
investigation scenarios

Module 1. Computer Forensics in

Module 8. Investigating Web Attacks
Today’s World

Module 2. Computer Forensics

Module 9. Database Forensics
Investigation Process

Module 3. Understanding Hard Disks

Module 10. Cloud Forensics
and File Systems

Module 4. Data Acquisition and

Module 11. Malware Forensics
Duplication

Module 5. Defeating Anti-Forensics

Module 12. Investigating Email Crimes
Techniques

Module 6. Operating System Forensics Module 13. Mobile Forensics

Module 14. Forensics Report Writing

Module 7. Network Forensics
and Presentation

CHFI v9 05
 WHY CHFI?

• EC-Council is one of the few organizations that specialize in information security (IS) to achieve ANSI
17024 accreditation for its Computer Hacking Forensic Investigator certification

• The CHFI v9 program has been redesigned and updated after thorough investigation including
current market requirements, job tasks analysis, and recent industry focus on forensic skills

• It is designed and developed by experienced subject matter experts and digital forensics practitioners

• CHFI is a complete vendor neutral course covering all major forensics investigations technologies and
solutions

• CHFI has detailed labs for hands-on learning experience. On an average, approximately 40% of
training time is dedicated to labs

• It covers all the relevant knowledge-bases and skills to meets with regulatory compliance standards
such as ISO 27001, PCI DSS, SOX, HIPPA, etc.

• The student kit contains large number of white papers for additional reading

• The program presents a repeatable forensics investigation methodology required from a versatile
digital forensic professional which increases employability

• The student kit contains several forensics investigation templates for evidence collection, chain-of-
custody, final investigation reports, etc.

• The program comes with cloud-based virtual labs enabling students to practice various investigation
techniques in a real-time and simulated environment

CHFI v9 06
 ENDORSEMENTS
AND
TESTIMONIALS

ENDORSEMENTS TESTIMONIALS

“It is my pleasure to take the time to praise the EC-Council for having
such a magnificent class, specifically THE Computer Hacking Forensic
Investigator course. The course had an abundance of information,
utilities, programs, and hands on experience. I am a consultant at Dell
and we do have a lot of technical training, but I must comment that
this one is one of the best trainings I have seen in several years. I will
definitively recommend this course to all my colleagues.”

— Hector Alvarez, CHFI, Enterprise & Storage Consultant,

Dell Corporation, Austin, Texas
The National Initiative American National
for Cybersecurity Standards Institute (ANSI) “ All the treatment has been excellent, the material and the content of
Education (NICE) the course overcomes my expectations. Thanks to the instructor and to
Itera for their professionalism.”

— Sergio Lopez Martin, CHFI, Security Sales, IBM, Spain

“ CHFI is a certification that gives an complete overview of the

process that a forensic investigator must follow when is investigating
a cybercrime. It includes not only the right treatment of the digital
evidence in order to be accepted in the Courts but also useful tools and
Committee on United States National Infocomm techniques that can be applied to investigate an incident.”
National Security Department of Competency
Systems (CNSS) Defense (DoD) Framework (NICF) — Virginia Aguilar, CHFI, KPMG, Madrid

“ The Computer Hacking Forensic Investigator (CHFI) certification

has been instrumental in assuring both my company and our clients
that my skillset is among the elite in the cyber security and response
profession. The CHFI allows my company to readily identify to our
DoD clients that our team is trained to perform the rigorous functions
required of cyber threat response team. Our company can now better
brand our capability to investigate cyber security incidents, perform
computer/malware forensic analysis, identify active threats, and report
Department of KOMLEK MSC
our findings.”
Veterans Affairs
— Brad W. Beatty, Cyber Security Analyst, Booz Allen Hamilton, USA

CHFI v9 07
 About EC-Council
EC-Council has been the world’s leading information security certification body since the launch of their flagship program,
Certified Ethical Hacker (CEH), which created the ethical hacking industry in 2002. Since the launch of CEH, EC-Council has
added industry-leading programs to their portfolio to cover all aspects of information security including EC-Council Certified
Security Analyst (ECSA), Computer Hacking Forensics Investigator (CHFI), Certified Chief Information Security Officer (CCISO),
among others. EC-Council Foundation, the non-profit branch of EC-Council, created Global CyberLympics, the world’s first
global hacking competition. EC-Council Foundation also hosts a suite of conferences across the US and around the world
including Hacker Halted, Global CISO Forum, TakeDownCon, and CISO Summit.

For more information about EC-Council, please see www.eccouncil.org.

CHFI v9EC-Council. All Rights Reserved. | CHFI 01/17

@2017 08