CHFI Study Guide — How to Pass Computer Hacking Forensic Investigator

Weeks 1–3

Computer Forensics Investigation Process: methodology, legal standards, chain of custody, documentation

Tip: The computer forensics investigation process: First Response (secure the scene, photograph equipment in place) → Seizure and Acquisition (create forensic image, document serial numbers) → Analysis (examine the image, not original) → Reporting (document findings in court-admissible format). Know what happens if any step is skipped — evidence may be inadmissible.

Weeks 4–6

Disk and File System Forensics: file systems (NTFS, FAT32, ext4), deleted file recovery, slack space

Tip: Know how file deletion works at the filesystem level: deleting a file marks the space as available but does not overwrite data until the OS writes new data to that location. This is why deleted file recovery is possible. Know tools: Autopsy, FTK (Forensic Toolkit), EnCase — and what each does.

Weeks 7–9

Network Forensics, Email Forensics, and Log Analysis

Tip: Email header analysis is a CHFI core skill. Know what each email header field contains: Received (each hop the email passed through, in reverse chronological order), From, Reply-To, X-Originating-IP (sender's IP address). Questions give an email header and ask you to trace the origin or identify spoofing.

Weeks 10–13

Mobile Forensics, Cloud Forensics, Malware Forensics, and Anti-Forensics

Tip: Mobile device forensics: know the acquisition types — physical (bit-by-bit image of flash memory, most complete), logical (file system level, misses deleted data), and cloud backup (quick but limited). Faraway/aviation mode must be enabled before imaging to prevent remote wipe. Know the Cellebrite UFED as the primary mobile forensics tool.