Study guide
CHFI study guide
Read a lesson, then practice the ideas you want to remember.
Lessons
- Secure Wiping, Degaussing, File Shredding Co
- Steganography Detection: Spatial/Frequency D
- Timestomping Countermeasures: Comparing $STA
- Commercial Forensic Platforms: EnCase Forens
- Open-Source Forensic Platforms: Autopsy, The
- Specialized DFIR Utilities: Eric Zimmerman T
- MySQL Forensics: Internal Architecture, Data
- SQL Server Forensics: SSMS, ApexSQL, SQLCMD
- Web Application Firewall Architecture, Audit
- Chain of Custody Documentation, Evidence Pac
- Electronic Discovery Reference Model & Legal
- Expert Witness Testimony, Report Writing Sta
- Bit-Stream Disk Imaging, Physical vs. Logica
- Forensic Image Formats & Cryptographic Hashi
- Hardware and Software Write-Blockers: Operat
- AI-Assisted Forensics, GitOps, Automation/Or
- Cybercrime Classifications, Forensic Science
- Indicators of Compromise, Cyber Attribution
- RFC 3227 Order of Volatility, Live vs. Dead
- Browser Artifact Recovery, Private Browsing,
- Multimedia Forensics: Image, Audio & Video A
- Social Media, Social Engineering, Insider Th
- Virtualization, Container & Microservices Fo
- Physical Evidence Packaging, Anti-Static/Far
- First Responder Duties: Crime Scene Containm
- Forensic Laboratory Accreditation: ISO/IEC 1
- Cybercrime Statutes, Privacy Compliance, CAN
- Fourth Amendment, Warrant Exceptions, Workpl
- Federal Rules of Evidence & Daubert/Frye Sta
- International Standards: ISO/IEC 27037, ACPO
- .NET Managed Malware Analysis & the GOOTLOAD
- Dynamic Malware Analysis: Sandboxing, Proces
- Volatile Memory Acquisition: RAM Capture, Cr
- Static Malware Triage: Strings, PE Headers,
- Memory Analysis with Volatility 3: pslist, p
- Cloud Forensics: AWS CloudTrail, Azure Activ
- IoT Forensics: UART/JTAG Physical Interfaces
- Mobile Artifact Analysis: Call Logs, SMS/Cha
- Mobile Device Forensics: Manual, Logical, Fi
- Blockchain Transactions, Cryptocurrency Trac
- Dark Web, Tor Network, Onion Routing & Hidde
- Fileless Malware, In-Memory Execution & Livi
- IoT & Operational Technology Forensic Fundam
- Email Forensics: RFC 5322 Headers, Authentic
- Network Device & Service Log Forensics: Fire
- Network Forensics: PCAP Analysis, Protocol D
- SIEM Event Correlation, Cross-Source Timelin
- Investigating Directory Traversal, Command I
- Web Server Forensics: Apache/IIS Access Logs
- Wireless Network Forensics: Rogue APs, Evil
- File Signatures, Magic Bytes, Hex Headers/Fo
- Linux File Systems: ext2/ext3/ext4 Inode Arc
- macOS File Systems: HFS+ and Apple File Syst
- Partition Tables & Boot Structures: MBR, GPT
- RAID Reconstruction & SSD Forensic Challenge
- Storage Media Architecture: Sectors, Cluster
- Python for Digital Forensics: Parsing Raw Ar
- Reverse Engineering & Password Cracking: Ghi
- Forensic Tool Testing & Validation: NIST CFT
- FAT12/16/32 and exFAT Architecture, Director
- NTFS Artifacts: Alternate Data Streams, Volu
- NTFS Architecture: Master File Table Record
- Windows Event Log Forensics: Security Audit
- Execution Artifacts: Prefetch, Shimcache, Am
- Windows Registry Forensics: SYSTEM, SOFTWARE
- User Activity Artifacts: ShellBags, LNK Shor