Chapter 1 of 6 · EC-Council 312-49
Forensic Science
Cybercrime, anti-forensics, readiness, acquisition, cloud, email, malware, IoT and OT, worth 15 percent.
- 9topics
- 45 minfast track
- 1diagrams and exhibits
- 15%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Cybercrime, Attribution and Indicators of CompromiseLearn the types of computer crime, their impact, attribution, investigation challenges, indicators of compromise and the signs of…5 min
- 2Anti-Forensics and Computer Forensics BasicsLearn what anti-forensics is, how its techniques are detected and countered, and why and when computer forensics is used…5 min
- 3Forensic Readiness and Incident ResponseLearn forensic readiness, how forensics fits the incident response plan and flow, and the roles of the SOC, threat intelligence…5 min
- 4The Forensic Investigator and EthicsLearn why a forensic investigator is needed, the roles, qualities and code of ethics, managing clients and the factors that shape…5 min
- 5Network Forensics and Data AcquisitionLearn network forensics, postmortem and real time analysis, FaaS, live and dead acquisition, order of volatility, rules of thumb…5 min
- 6Dark Web, MySQL and Cloud ForensicsLearn the dark web and TOR relays and bridges, the MySQL data directory, cloud service and deployment models, cloud threats, AWS…5 min
- 7Email and Malware FundamentalsLearn how email is delivered, how to read message headers, and the components, distribution, types and coordinated handling of…Diagram5 min
- 8Fileless and .NET MalwareLearn fileless malware and its infection chain, memory, web, document and container routes, memfd_create detection on Linux, and…5 min
- 9IoT, OT and Multimedia ForensicsLearn IoT architecture, security problems, the OWASP IoT Top 10, IoT and OT threats and attack surfaces, and the multimedia…5 min
About this chapter
What this chapter covers
Forensic Science is 15% of the EC-Council CHFI v11 312-49 exam. It covers the types of cybercrime and how they are investigated, anti-forensics, forensic readiness and incident response, the investigator's role, data acquisition, the dark web, databases and the cloud, email, malware, and the IoT and OT environments you may have to examine.
Questions are single-answer multiple choice on procedure, evidence integrity, artifacts and tool choice. You are asked to name a concept, put steps in order, or pick the right action for a scenario.
It has 71 outline topics, and nine pages cover them.
How the topics fit together
The chapter moves from the crime to the preparation, the evidence and then the environments you examine.
- Crime and anti-forensics explain what you investigate and what hides it.
- Readiness, the investigator and acquisition explain how you prepare and collect evidence correctly.
- Dark web, cloud, email, malware, IoT and OT explain where the evidence lives in each environment.
When two answers both sound useful, pick the one that preserves the original evidence first. Order of volatility and a bit by bit copy come before analysis.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with diagrams and example commands.
- What to remember for the exam: the facts to memorize.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Try to match each short scenario to its concept before reading the answer. The exam often describes symptoms and asks for the term or the best next step.
Ready for more practice?
The full EC-Council 312-49 question bank has 900 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.