Chapter 4 of 6 · EC-Council 312-49
Procedures and Methodology
Lab, first response, acquisition, analysis, eDiscovery, special sources, malware. 17 percent.
- 11topics
- 57 minfast track
- 2diagrams and exhibits
- 17%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Forensic Investigation Process and Forensic LabLearn the phases of a forensic investigation, why a defined process matters, and how to build, staff, validate and quality check…5 min
- 2First Response and the Electronic Crime SceneWhat a first responder does, common mistakes, health and safety, crime scene documentation, search and seizure, and evidence…5 min
- 3Analysis, Reporting, Expert Testimony and Mobile ForensicsData and case analysis, forensic reports, expert witness testimony, Electron and chat app artifacts, and the mobile forensics…5 min
- 4Social Media, Insider, Cryptocurrency, Virtual, Cloud and Container ForensicsForensic methods for social media, social engineering, insider threats, identity theft, cryptocurrency, virtual machines, cloud…5 min
- 5Bluetooth, IoT, OT and Multimedia Forensics, and Acquisition BasicsForensics for Bluetooth, IoT, OT and multimedia evidence, plus the first acquisition steps: determine the best acquisition method…5 min
- 6Volatile and Nonvolatile Acquisition, Write Protection and Live Mac CollectionAcquire volatile and nonvolatile data in order, enable write protection, plan contingencies, validate with hashes, and collect…Diagram6 min
- 7Database, Windows Log, Cloud and OT Data AcquisitionCollect SQL Server volatile data, data files, transaction logs, plan cache and error logs, plus Windows logs, and acquire from…5 min
- 8eDiscovery and Preparing Images for ExaminationLearn the eDiscovery flow, the EDRM cycle, metrics and cost control, then prepare and view forensic images safely on Windows…Diagram5 min
- 9Windows Analysis, Timelines and Event CorrelationAnalyze Windows memory, registry and artifacts, use Autopsy and The Sleuth Kit, build file system timelines, and correlate events…6 min
- 10macOS, Cloud Evidence and Dark Web AnalysisCollect and analyze macOS artifacts and user activity, analyze cloud digital evidence, and learn dark web forensics, safety rules…5 min
- 11Malware ForensicsWhy and how to analyze malware: challenges, extraction, indicators, safe lab and testbed setup, tools, rules, and static versus…5 min
About this chapter
What this chapter covers
Procedures and Methodology is 17% of the EC-Council CHFI v11 312-49 exam. It covers the forensic investigation process, building a forensic lab, first response, data acquisition, analysis methods, eDiscovery, reporting and testimony, and forensic methods for special sources such as mobile, cloud, containers, the dark web and malware.
Questions are single-answer multiple choice. You are asked to pick the correct step or order, the right acquisition method, the artifact that answers a question, or the tool that fits a task.
It has 90 outline topics, grouped into eleven pages.
How the topics fit together
The chapter follows a case from preparation to findings.
- Process, lab and first response set up the people, tools and scene handling that protect evidence.
- Acquisition is where order of volatility, write protection and hash validation apply.
- Analysis and special sources cover Windows, macOS, cloud, mobile, containers, the dark web and malware.
When a question asks what to do first, think preserve before acquire, acquire before analyze, and volatile before nonvolatile.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with diagrams and example commands.
- What to remember for the exam: the facts to memorize.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Try to match each short scenario to its step, method or tool before reading the answer. The exam often describes a situation and asks for the next step or the right method.
Ready for more practice?
The full EC-Council 312-49 question bank has 900 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.