CHFI Tests Evidence You Can Defend in Court — Not Just Tools You Can Name
CHFI v11 is a 150-question, four-hour exam for investigators. Think like an examiner who preserves, verifies and documents, not an incident responder racing to restore service.
Check Your Readiness →Most candidates understand EC-Council Computer Hacking Forensic Investigator (CHFI v11, Exam 312-49) concepts — and still fail. This exam tests how you apply knowledge under pressure.
Weights are nearly flat, so no domain can be skipped. Expect short recall items (event IDs, hex headers, hive names) mixed with next-step questions placed mid-investigation. Distractors are usually real tools or laws from the wrong category, so classification decides many answers.
Keep searching the drive for anything else related to the new crime
Stop and seek additional authority. A warrant is limited to the items it particularly describes; plain view lets you seize what is openly visible but never authorizes a fresh search for a new evidence category.
Normal user who mistyped the password a few times
4625 is a failed logon and 4624 a success, so a burst of failures ending in success indicates a brute-force or password-guessing attack that worked. Correlate the source address and follow the session that started.
A 200 status alone proves the data was stolen
Decode the payload first: %27 is a quote, so this is SQL injection. The oversized response, not the 200 code, suggests successful extraction. Confirm with database logs before stating impact.
Take a logical copy and carve deleted files as on an HDD
Only a physical bit-stream image captures unallocated and slack space, and even then TRIM and wear levelling may already have erased deleted blocks. Image physically, verify hashes, and report the SSD recovery limitation.
RFC 3227 order of volatility puts registers, cache, ARP tables and memory ahead of disk. Powering off a logged-in system loses processes, connections and access to a mounted BitLocker volume, so live memory capture comes first.
Volatility only parses a memory image. Acquisition needs FTK Imager or Belkasoft RAM Capturer on Windows, or the LiME kernel module on Linux and Android. The exam pairs capture tasks with analysis tools as distractors.
Every relay prepends its own Received line, so the originating hop sits at the bottom. The From field is trivially forged; corroborate the path with SPF, DKIM and DMARC results before naming a source.
A SHA-256 match proves the image content is unchanged; it says nothing about who held the evidence. Courts expect every transfer logged with date, time, person and purpose from seizure to testimony.
CloudTrail records management API calls such as DeleteBucket or TerminateInstances and who made them. Ports, IPs and bytes live in VPC Flow Logs. GuardDuty produces threat findings, not the authoritative audit trail.
Strengthen weak areas with exam-style practice questions and detailed explanations.
Simulate the real exam experience and assess your readiness under timed conditions.
Review key concepts, objectives, and exam topics in one place.
Get personalized explanations, learning recommendations, and instant answers.
Follow a structured learning path designed to help you prepare efficiently.
CHFI punishes mixing up capture tools, analysis tools and legal authority. Find your gaps.