EC-Council CHFI v11 Study Roadmap

Domain 1: Forensics fundamentals (Investigation methodology, legal considerations, lab setup)

Domain 1: Chain of custody, first responder procedures, documentation, expert testimony

Domain 2: Evidence acquisition (Forensic imaging, write blockers, live vs dead acquisition)

Domain 2: Evidence validation (Hashing, data carving, e-discovery, preservation)

Domain 3: Windows forensics (Registry analysis, event logs, NTFS artifacts, prefetch)

Domain 3: Linux/Mac forensics (ext4/HFS+/APFS, file recovery, timeline analysis)

Domain 3: Memory forensics (RAM analysis, volatile data, process examination)

Domain 4: Network forensics (Packet capture, Wireshark, network log analysis)

Domain 4: Web/Email forensics (Browser artifacts, email headers, proxy logs)

Domain 5: Database forensics (SQL analysis, transaction logs, data recovery)

Domain 5: Cloud/Mobile forensics (AWS/Azure evidence, Android/iOS acquisition)

Domain 5: IoT forensics (Embedded devices, malware forensics, dark web investigations)

Full Review: Practice exams, Case study exercises, Weak areas

Final Review: Timed practice exams, Tool proficiency check, Exam logistics