Chapter 5 of 6 · EC-Council 312-49

Digital Forensics

File systems, mobile, network, SIEM, web, cloud, malware and Python analysis, 29 percent of the exam.

  • 11topics
  • 1 h 4 minfast track
  • 3diagrams and exhibits
  • 29%of the exam
Start with Anti-Forensics, File Deletion and File Carving

Topics in this chapter

Take them in order, or jump to the one you need.

  1. 1Anti-Forensics, File Deletion and File CarvingWhat happens when a Windows file is deleted, the Recycle Bin, file carving, anti-forensics techniques and how examiners counter…Diagram6 min
  2. 2Windows Artifacts, Event Logs, TSK and TimelinesWindows file analysis, metadata, ShellBags, LNK files, Jump Lists, event logs, Sleuth Kit commands and timeline analysis with key…Diagram6 min
  3. 3Linux, macOS and Mobile Device ForensicsLinux memory forensics, macOS logs, APFS and Spotlight, plus Android and iOS acquisition, SQLite artifacts and mobile forensic…6 min
  4. 4Network Device Logs, SSH Logs and Packet SniffersAnalyze firewall, IDS, router, DHCP, switch, VPN, DNS and SSH logs, plus network protocols, packet capture and sniffing tools…6 min
  5. 5Analyzing Attack Traffic in Packet CapturesSpot SYN and UDP floods, HTTP floods, FTP and SMB password guessing, sniffing, malware beacons, SMTP and SNMP abuse in packet…5 min
  6. 6SIEM, Centralized Logging and Attack DetectionHow SIEM centralizes and correlates logs to expose brute force, DoS, malware, FTP exfiltration, scanning, ransomware and rogue…5 min
  7. 7Wireless and Web Application Attack InvestigationInvestigate Wi-Fi weaknesses, rogue access points, jamming, XSS, SQL injection, traversal, command injection, XXE and cookie…6 min
  8. 8Database, Tor Browser, Dark Web and Email ForensicsSQL Server and MySQL forensics, memory dump collection, Bulk Extractor, Tor Browser artifacts, dark web challenges and email…6 min
  9. 9Cloud and IoT Forensics for Azure, AWS, Google and Smart DevicesCloud forensics for Azure, AWS, Google Workspace and Google Cloud, VM and snapshot acquisition, plus smartwatch and Amazon Echo…6 min
  10. 10Malware Forensics, Persistence and Behavior AnalysisStatic and dynamic malware analysis, malicious Office and PDF files, registry persistence, system behavior analysis and…Diagram6 min
  11. 11Python for Digital ForensicsUse Python for forensic hashing, acquisition, Windows and Linux artifacts, malware, web, cloud, email, mobile, IoT and multimedia…6 min

About this chapter

What this chapter covers

Digital Forensics is 29% of the EC-Council CHFI v11 312-49 exam, the largest chapter. It covers anti-forensics and file recovery, Windows, Linux and macOS artifacts, mobile devices, network and wireless evidence, SIEM, web and database attacks, Tor and email, cloud and IoT, malware analysis and forensic scripting in Python.

Questions are single-answer multiple choice. They ask about procedure, evidence integrity, where an artifact lives and what it shows, and which tool fits the task.

It has 87 outline topics, and eleven pages cover them.

How the topics fit together

The chapter follows the evidence from the single computer outward to networks, the cloud and automation.

Host artifactsdeletion, Windows, Linux, macOSMobileAndroid and iOSNetworklogs, packets, SIEM, wirelessApplicationsweb, database, Tor, emailCloud and IoTMalware and Python
  • Host and mobile pages show what a device keeps and how it is recovered.
  • Network pages show what attacks look like in logs and packet captures.
  • Application, cloud and malware pages apply the same thinking to services and code, and Python automates it.
Exam tip

When a question describes a pattern in a log or capture, name the artifact or attack first, then pick the tool or filter. The pattern usually decides the answer.

How to use these pages

Each topic page has the same shape, so you can skim for what you need.

  • What it is: the idea in plain words.
  • How it works: the mechanism, with diagrams and example commands.
  • What to remember for the exam: the facts to memorize.
  • Common mistakes: the classic traps.
  • Check yourself: three questions to test your understanding.

Try to match each short scenario to its attack or artifact before reading the answer. The exam often describes symptoms and asks for the name or the best next step.

Ready for more practice?

The full EC-Council 312-49 question bank has 900 questions, with timed practice exams and an explanation for every answer.

SubscribeTry Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.