Chapter 6 of 6 · EC-Council 312-49
Tools, Systems and Programs
Imaging, recovery, password, memory, network, mobile, cloud and log tools, worth 11 percent.
- 6topics
- 28 minfast track
- 11%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1File System, Imaging and Recovery ToolsLearn which tools analyze file systems and formats, acquire and validate evidence, handle eDiscovery, image drives, carve files…4 min
- 2Password, Hidden Data and Packer ToolsLearn rainbow tables, password cracking and reset tools, and tools that detect steganography, alternate data streams, mismatches…5 min
- 3Windows, Linux and macOS Artifact ToolsLearn tools for live collection, Windows memory and registry, browser artifacts, ShellBags, LNK files, Linux and APFS analysis…5 min
- 4Network, Memory and Malware ToolsLearn tools for network traffic, SIEM, web attack logs, TOR artifacts, memory dump acquisition and analysis, malware analysis and…5 min
- 5Mobile, Database, Cloud, Email and IoT ToolsLearn tools for Android and iOS acquisition, mobile suites, MSSQL and MySQL evidence, Azure and AWS investigation, email recovery…4 min
- 6Log, Social Media, Insider Threat and Blockchain ToolsLearn network log and traffic tools, social media forensics, insider threat tools, IIS and Apache log analyzers, blockchain and…5 min
About this chapter
What this chapter covers
Tools, Systems and Programs is 11% of the EC-Council CHFI v11 312-49 exam. It covers which forensic tool fits which task: imaging and validation, file recovery, passwords, hidden data, Windows, Linux and macOS artifacts, memory, network, malware, mobile, database, cloud, email, IoT, log and blockchain investigations.
Questions are single-answer multiple choice. You are given a task or a scenario and asked to pick the right tool, the right artifact to examine, or the correct next step.
It has 51 outline topics, grouped into six pages.
How the topics fit together
The chapter follows the order of an investigation, from copying evidence to analyzing specific platforms.
- Imaging and recovery tools protect and rebuild the evidence.
- Password and hidden data tools open and reveal what is concealed.
- Platform, memory, network and malware tools read the artifacts of each environment.
- Mobile, cloud, log and blockchain tools cover newer evidence sources.
For each tool, memorize one sentence: what it does and what category it belongs to. Most questions give a task and four tool names from different categories.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with diagrams and example commands.
- What to remember for the exam: the facts to memorize.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Cover the tool names in each table and try to recall them from the task description. The exam often describes the job and asks which tool does it.
Ready for more practice?
The full EC-Council 312-49 question bank has 900 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.