EC-Council CHFI v11 Study Roadmap

Domain 1: Forensics fundamentals — Investigation methodology, legal considerations, lab setup

Domain 1: Chain of custody, first responder procedures, documentation, expert testimony

Domain 2: Evidence acquisition — Forensic imaging, write blockers, live vs dead acquisition

Domain 2: Evidence validation — Hashing, data carving, e-discovery, preservation

Domain 3: Windows forensics — Registry analysis, event logs, NTFS artifacts, prefetch

Domain 3: Linux/Mac forensics — ext4/HFS+/APFS, file recovery, timeline analysis

Domain 3: Memory forensics — RAM analysis, volatile data, process examination

Domain 4: Network forensics — Packet capture, Wireshark, network log analysis

Domain 4: Web/Email forensics — Browser artifacts, email headers, proxy logs

Domain 5: Database forensics — SQL analysis, transaction logs, data recovery

Domain 5: Cloud/Mobile forensics — AWS/Azure evidence, Android/iOS acquisition

Domain 5: IoT forensics — Embedded devices, malware forensics, dark web investigations

Full Review: Practice exams, Case study exercises, Weak areas

Final Review: Timed practice exams, Tool proficiency check, Exam logistics