Skip to main content
Ace Skills Consulting
EC-Council logoAdvanced

312-49: Computer Hacking Forensic Investigator (CHFI)

Investigate cyber incidents with forensically sound methods — and prepare for the CHFI 312-49 exam with practical case work.

  • 40 hours of live, investigation-focused training
  • Evidence acquisition and chain of custody in practice
  • Windows, Linux, network, cloud and mobile forensics
  • Malware and email investigation labs
  • Practice questions mapped to the exam areas
Aligned to EC-Council exam 312-49
Duration
5 Days | 40 Hrs
Next batch
Batches on request
Delivery
Live Online · Onsite · Corporate
Level
Advanced
Exam
312-49
Language
English

Why learn 312-49 with Ace Skills

  • Real investigation practice

    Work a realistic case from first response to final report across the week.

  • Forensically sound methods

    Learn evidence handling that preserves integrity and stands up to scrutiny.

  • Every major evidence source

    Analyse disks, memory, logs, network traffic, cloud, mobile and email.

  • Exam-aligned preparation

    Topics follow the published CHFI exam areas with regular practice questions.

Course overview

When a breach, fraud or insider incident happens, organisations need to know exactly what occurred, and they need evidence that will stand up to scrutiny from management, regulators or a court. Digital forensic investigators provide that. This five-day course is exam-aligned preparation for the CHFI 312-49 exam, built around a realistic investigation that runs through the week.

Day one establishes the foundations: the forensic investigation process, legal considerations, first response, evidence handling and chain of custody, and how hard disks and file systems store data. Day two covers data acquisition and duplication, anti-forensics techniques and how to defeat them, and Windows forensics, including the registry, event logs, memory and user activity artefacts. Day three moves to Linux and macOS forensics and network forensics, using logs and packet captures to reconstruct events.

Day four covers web attack investigation, the dark web, email crimes and malware forensics, including static and dynamic analysis basics. Day five addresses cloud, mobile and IoT forensics, then brings the week together with writing a forensic report and an exam-readiness session.

This is independent, exam-aligned training; it does not use EC-Council courseware and Ace Skills Consulting does not claim to be an EC-Council Accredited Training Centre. Exam eligibility and registration are handled through EC-Council’s official channels, so confirm the current version and requirements with EC-Council before booking.

Key features

  • Week-long investigation case with real artefacts
  • Disk imaging and verification labs
  • Memory and registry analysis
  • Network, email and malware investigation exercises
  • Forensic report writing workshop
  • Practice questions with explanations
  • Course completion certificate from Ace Skills Consulting

Who should attend

  • Incident responders and SOC analysts
  • Digital forensics and e-discovery professionals
  • Law enforcement and fraud investigation staff
  • IT security professionals handling internal investigations

Prerequisites

  • Strong understanding of operating systems and networking
  • Security fundamentals at Security+ or CEH level
  • Comfort with command-line tools

Curriculum

5 Days · 40 Hours · 14 Modules · 9 Labs

  1. Forensic investigation process

    • Phases of an investigation
    • Legal considerations and admissibility
    • First response and scene handling
    • Chain of custody

    Hard disks and file systems

    • Disk structures and partitions
    • NTFS, FAT and ext file systems
    • Boot processes
    • Deleted file recovery concepts
    • Lab: Examine file system structures and recover deleted files · 50 min

    Building the case

    • Case briefing and scoping
    • Documentation standards

  2. Data acquisition and duplication

    • Live versus dead acquisition
    • Write blockers and imaging formats
    • Hash verification
    • Memory acquisition
    • Lab: Create and verify a forensic disk image · 45 min

    Anti-forensics

    • Data hiding and steganography
    • Wiping and timestamp manipulation
    • Detecting anti-forensics

    Windows forensics

    • Registry analysis
    • Event logs
    • User activity artefacts
    • Memory analysis
    • Lab: Build a timeline of user activity from Windows artefacts · 60 min

  3. Linux and macOS forensics

    • Linux log and shell history analysis
    • Linux memory forensics
    • macOS file system and artefacts
    • Lab: Investigate a compromised Linux server · 50 min

    Network forensics

    • Log correlation
    • Packet capture analysis
    • Investigating network attacks
    • Wireless investigation basics
    • Lab: Reconstruct an intrusion from packet captures and logs · 55 min

  4. Web attacks and the dark web

    • Web server log analysis
    • Investigating web application attacks
    • Dark web investigation concepts
    • Lab: Trace a web attack through server logs · 40 min

    Email investigation

    • Email architecture and headers
    • Phishing and spoofing investigation
    • Email evidence collection

    Malware forensics

    • Static analysis basics
    • Dynamic analysis in a sandbox
    • Indicators of compromise
    • Fileless malware investigation
    • Lab: Analyse a malware sample in a sandbox · 50 min

  5. Cloud forensics

    • Challenges of cloud investigations
    • Collecting evidence from AWS and Azure logs
    • Container forensics

    Mobile and IoT forensics

    • Android and iOS acquisition approaches
    • Mobile artefacts
    • IoT device investigation
    • Lab: Review artefacts from a mobile device image · 35 min

    Reporting and exam readiness

    • Writing a forensic report
    • Presenting findings and expert testimony basics
    • Practice questions and review
    • Lab: Write the final report for the week’s case · 40 min
Download full syllabus (PDF)

Skills you will gain

  • Digital forensics
  • Chain of custody
  • Disk imaging
  • File system analysis
  • Windows forensics
  • Memory forensics
  • Linux forensics
  • Network forensics
  • Email investigation
  • Malware analysis
  • Cloud forensics
  • Mobile forensics
  • Forensic reporting

Tools & technologies

  • Autopsy
  • FTK Imager
  • Volatility
  • Wireshark
  • Registry Explorer
  • Sleuth Kit
  • CyberChef
  • REMnux

Certification exam

Exam details
Exam nameComputer Hacking Forensic Investigator (CHFI)
Exam code312-49
Voucher includedNo — book directly with the vendor
Question formatMultiple choice

Skill areas measured

  1. Computer forensics fundamentals and the investigation process
  2. Hard disks, file systems and data acquisition
  3. Anti-forensics techniques
  4. Windows, Linux and macOS forensics
  5. Network and web attack investigation
  6. Dark web and email crime investigation
  7. Malware forensics
  8. Cloud, mobile and IoT forensics

Exam details are pending verification. Vendors change exams; confirm on the official vendor page before booking. Official exam page (opens in a new tab)

Schedule & Pricing

Live Online

Individual

Price on request

  • 40 hours of live, trainer-led sessions
  • 9 hands-on labs
  • Ace Skills course completion certificate

Onsite

At your office or our centre

Pricing depends on location, group size and dates.

  • Delivered at your premises or an Ace centre
  • Same curriculum and labs as live online
  • Dates planned around your team

Corporate / Team

Private batch for your organisation

A private batch with content adapted to your environment and goals.

  • Customised curriculum
  • Private batch, online or onsite
  • Progress and assessment reports
  • GST invoice and PO-based billing

No public batches scheduled — Talk to an Advisor for a private batch.

Projects & labs you will build

  • Day 2 · 45 min

    Create and verify a forensic disk image

  • Day 3 · 55 min

    Reconstruct an intrusion from packet captures and logs

Your certificate

Certificate of Completion — Ace Skills Consulting

Awarded on completing the course. It records the course title and training hours, and you can share it on your LinkedIn profile.

The EC-Council certification itself is awarded by EC-Council when you pass exam 312-49.

Frequently asked questions

How do I register for the CHFI exam?

Registration and eligibility are handled through EC-Council’s official channels. We explain the process, but vouchers and eligibility decisions come from EC-Council.

Is this official EC-Council training?

No. This is independent, exam-aligned preparation using our own material and case studies.

Do I need CEH before CHFI?

It is not required, but CEH-level understanding of attacks makes investigations much easier to follow.

Which tools will I use?

Mainly free and open-source forensic tools such as Autopsy, Volatility and Wireshark, so you can continue practising afterwards.

Can you run this for an investigations team?

Yes. Private batches can focus on the evidence sources most relevant to your organisation.

Related courses

Explore more

All Cybersecurity courses EC-Council certifications

CEH, CHFI and CND are trademarks of the International Council of E-Commerce Consultants (EC-Council).

Train your team on 312-49

Private batches online or at your office in India and the GCC, with a curriculum adapted to your environment.