Chapter 2 of 6 · EC-Council 312-49
Regulations, Policies and Ethics
Rules of evidence, warrants, consent, custody, eDiscovery, laws and ISO standards.
- 4topics
- 22 minfast track
- 1diagrams and exhibits
- 10%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Rules of Evidence and Handling Digital EvidenceLearn the rules of evidence, best evidence rule, Federal Rules of Evidence, ACPO principles, forensics versus eDiscovery, AI and…6 min
- 2Search, Seizure, Preservation and Chain of CustodyLearn consent, witness signatures, warrants and warrantless searches, the scene search, preservation, chain of custody and media…Diagram6 min
- 3eDiscovery, Agencies and Privacy LawLearn business records as evidence, division of responsibilities, eDiscovery roles, law enforcement agencies, privacy and…5 min
- 4Malware Law, CAN-SPAM and Forensic StandardsLearn legal challenges in handling malware, the CAN-SPAM Act, the ISO/IEC digital evidence standards and ENFSI best practices for…5 min
About this chapter
What this chapter covers
Regulations, Policies and Ethics is 10% of the EC-Council CHFI v11 312-49 exam. It covers the rules of evidence, how evidence is obtained lawfully through consent or a warrant, how it is preserved and tracked, eDiscovery, the laws and standards that shape forensic work, and the standards that guide good practice.
Questions are single-answer multiple choice on procedure, evidence integrity, legal requirements and the correct standard or law to name.
It has 25 outline topics, and four pages cover them.
How the topics fit together
The chapter follows the path of evidence from legal authority to court.
- Rules of evidence say what a court will accept.
- Authority and scene handling say how you may collect and protect it.
- eDiscovery, laws and standards say who is responsible and which rules apply.
Legal authority comes before technical action. If the question asks what to do first at a scene, the answer is usually to secure it and confirm authority, not to start copying data.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with diagrams and example commands.
- What to remember for the exam: the facts to memorize.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Try to match each short scenario to its rule or law before reading the answer. The exam often describes a situation and asks which rule applies or what the investigator must do.
Ready for more practice?
The full EC-Council 312-49 question bank has 900 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.