Chapter 3 of 6 · EC-Council 312-49
Digital Evidence
Evidence types, disks, boot, mobile, cellular, logs, file formats, WAF and databases, worth 18 percent.
- 8topics
- 42 minfast track
- 1diagrams and exhibits
- 18%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Digital Evidence and Disk StorageLearn the types, characteristics and sources of digital evidence, plus HDD and SSD structure, MBR and GPT, RAID, NAS and SAN, and…6 min
- 2Boot Processes and File SystemsUnderstand Windows, macOS and Linux boot, key Windows system files, NTFS, FAT, ext4 and APFS file systems, and macOS logs and…Diagram5 min
- 3Mobile Device Architecture and AcquisitionLearn Android and iOS architecture and boot, mobile storage and evidence locations, acquisition methods, file systems, rooting…5 min
- 4Cellular Networks and SIM EvidenceUnderstand cellular network components, GSM, CDMA, LTE and 5G, cell site analysis, CDR contents and SIM identifiers and files for…5 min
- 5Network Evidence and Windows Event LogsLearn network evidence types, Windows logon types, EVT and EVTX formats, event record structures, Windows 11 audit events and…5 min
- 6Log Admissibility and Web Server LogsLearn when logs are admissible as evidence, how to keep them authentic and intact, centralized log management, and how to read…6 min
- 7Hex Encoding and File Format AnalysisLearn ASCII and Unicode encoding, offsets, hex editors, file signatures for JPEG, BMP and Office files, EXIF metadata and PDF…5 min
- 8WAF and Database ForensicsUnderstand WAF benefits and limits, SQL Server storage, database evidence repositories, and MySQL logs, information schema and…5 min
About this chapter
What this chapter covers
Digital Evidence is 18% of the EC-Council CHFI v11 312-49 exam. It covers what digital evidence is, where it lives, how disks, operating systems and mobile devices store it, and how logs, files, web application firewalls and databases are read as evidence.
Questions are single-answer multiple choice on procedure, evidence integrity, artifacts and tool choice. You are asked where an artifact lives, what a structure or event ID means, or which source answers a given question.
It has 60 outline topics, grouped into eight pages.
How the topics fit together
The chapter moves from the evidence itself to the media that holds it, then to the systems and logs that create it.
- Evidence and storage define what you collect and how drives lay data out.
- Boot, file systems, mobile and cellular show where operating systems and phones keep traces.
- Logs, file formats, WAF and databases show how to read the records that applications and servers produce.
Memorize structures with fixed sizes and signatures, such as the 512 byte MBR, the GPT header at LBA 1 and file header bytes. Many questions are answered from those numbers alone.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with diagrams and example commands.
- What to remember for the exam: the facts to memorize.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Try to answer each short scenario before reading the answer. The exam often describes a situation and asks for the artifact, the structure or the next step.
Ready for more practice?
The full EC-Council 312-49 question bank has 900 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.