Free study guide

EC-Council 312-49 Study Guide

EC-Council Computer Hacking Forensic Investigator (CHFI) v11 312-49

EC-Council Computer Hacking Forensic Investigator (CHFI) v11, exam 312-49, tests the knowledge needed to investigate cyber incidents and present digital evidence that holds up. It covers forensic science, laws and ethics, evidence handling and acquisition, the investigation process, forensics across disks, operating systems, networks, web, cloud, email, malware, mobile and IoT, and forensic tools. It suits forensic investigators, incident responders and law enforcement.

  • Exam code 312-49
  • Professional level
  • 6 exam domains

This guide is free, with no sign-up. It explains every EC-Council 312-49 exam topic in plain English, one chapter at a time. Read them in order or jump straight to the topic you need.

  • 6chapters
  • 49topics
  • 8diagrams and exhibits
  • 4 h 18 minfast track
Start with Forensic Science
  • Every topic follows the same simple pattern: what it is, how it works, common mistakes
  • Diagrams and real command output where a picture explains it best
  • Exam tips and worked subnetting and IPv6 practice, with answers

How the exam is weighted

Each domain is worth this share of the exam, so spend your study time in proportion. Select a domain to open its chapter.

Chapters

Open a chapter to see its topics and how long each takes.

1Forensic Science9 topics · 45 min fast trackCybercrime, anti-forensics, readiness, acquisition, cloud, email, malware, IoT and OT, worth 15 percent.
  1. 1Cybercrime, Attribution and Indicators of Compromise5 min
  2. 2Anti-Forensics and Computer Forensics Basics5 min
  3. 3Forensic Readiness and Incident Response5 min
  4. 4The Forensic Investigator and Ethics5 min
  5. 5Network Forensics and Data Acquisition5 min
  6. 6Dark Web, MySQL and Cloud Forensics5 min
  7. 7Email and Malware Fundamentals5 min
  8. 8Fileless and .NET Malware5 min
  9. 9IoT, OT and Multimedia Forensics5 min
Read the chapter overview →
2Regulations, Policies and Ethics4 topics · 22 min fast trackRules of evidence, warrants, consent, custody, eDiscovery, laws and ISO standards.
  1. 1Rules of Evidence and Handling Digital Evidence6 min
  2. 2Search, Seizure, Preservation and Chain of Custody6 min
  3. 3eDiscovery, Agencies and Privacy Law5 min
  4. 4Malware Law, CAN-SPAM and Forensic Standards5 min
Read the chapter overview →
3Digital Evidence8 topics · 42 min fast trackEvidence types, disks, boot, mobile, cellular, logs, file formats, WAF and databases, worth 18 percent.
  1. 1Digital Evidence and Disk Storage6 min
  2. 2Boot Processes and File Systems5 min
  3. 3Mobile Device Architecture and Acquisition5 min
  4. 4Cellular Networks and SIM Evidence5 min
  5. 5Network Evidence and Windows Event Logs5 min
  6. 6Log Admissibility and Web Server Logs6 min
  7. 7Hex Encoding and File Format Analysis5 min
  8. 8WAF and Database Forensics5 min
Read the chapter overview →
4Procedures and Methodology11 topics · 57 min fast trackLab, first response, acquisition, analysis, eDiscovery, special sources, malware. 17 percent.
  1. 1Forensic Investigation Process and Forensic Lab5 min
  2. 2First Response and the Electronic Crime Scene5 min
  3. 3Analysis, Reporting, Expert Testimony and Mobile Forensics5 min
  4. 4Social Media, Insider, Cryptocurrency, Virtual, Cloud and Container Forensics5 min
  5. 5Bluetooth, IoT, OT and Multimedia Forensics, and Acquisition Basics5 min
  6. 6Volatile and Nonvolatile Acquisition, Write Protection and Live Mac Collection6 min
  7. 7Database, Windows Log, Cloud and OT Data Acquisition5 min
  8. 8eDiscovery and Preparing Images for Examination5 min
  9. 9Windows Analysis, Timelines and Event Correlation6 min
  10. 10macOS, Cloud Evidence and Dark Web Analysis5 min
  11. 11Malware Forensics5 min
Read the chapter overview →
5Digital Forensics11 topics · 1 h 4 min fast trackFile systems, mobile, network, SIEM, web, cloud, malware and Python analysis, 29 percent of the exam.
  1. 1Anti-Forensics, File Deletion and File Carving6 min
  2. 2Windows Artifacts, Event Logs, TSK and Timelines6 min
  3. 3Linux, macOS and Mobile Device Forensics6 min
  4. 4Network Device Logs, SSH Logs and Packet Sniffers6 min
  5. 5Analyzing Attack Traffic in Packet Captures5 min
  6. 6SIEM, Centralized Logging and Attack Detection5 min
  7. 7Wireless and Web Application Attack Investigation6 min
  8. 8Database, Tor Browser, Dark Web and Email Forensics6 min
  9. 9Cloud and IoT Forensics for Azure, AWS, Google and Smart Devices6 min
  10. 10Malware Forensics, Persistence and Behavior Analysis6 min
  11. 11Python for Digital Forensics6 min
Read the chapter overview →
6Tools, Systems and Programs6 topics · 28 min fast trackImaging, recovery, password, memory, network, mobile, cloud and log tools, worth 11 percent.
  1. 1File System, Imaging and Recovery Tools4 min
  2. 2Password, Hidden Data and Packer Tools5 min
  3. 3Windows, Linux and macOS Artifact Tools5 min
  4. 4Network, Memory and Malware Tools5 min
  5. 5Mobile, Database, Cloud, Email and IoT Tools4 min
  6. 6Log, Social Media, Insider Threat and Blockchain Tools5 min
Read the chapter overview →

Ready for more practice?

The full EC-Council 312-49 question bank has 900 questions, with timed practice exams and an explanation for every answer.

SubscribeTry Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.