CHFI · Domain 3 of 6

CHFI Domain 3: Digital Evidence

Digital Evidence is 17% of CHFI v11 and spans five sub-domains: what makes data evidence, how disks, file systems and operating systems store it, which logs record activity, how encoding and file signatures work, and how WAFs and MySQL keep records.

Exam weight
17%
Official sub-domains
5
Estimated questions estimate
~26
Suggested study time estimate
12–16 hrs

About 14 min read Reviewed October 2026

Overview

Domain 3 explains where digital evidence comes from and how it is stored. It starts with the characteristics and types of evidence: volatile and non-volatile, active and residual data, and the qualities that make it usable, such as being authentic, complete and reliable. It then covers storage and operating system internals, including hard disk and SSD structure, sectors and clusters, MBR and GPT partitioning, the boot process on Windows, Linux and macOS, file systems such as NTFS, FAT, ext4 and APFS, and mobile operating system architecture for Android and iOS.

Later sub-domains look at logs, including Windows event logs, Linux syslog, and IIS and Apache web server logs, and at what makes a log admissible. Encoding covers ASCII, Unicode and Base64, hex editing and file signatures (magic numbers) for formats such as JPEG, PDF and ZIP. The last sub-domain explains how web application firewalls filter traffic and how MySQL stores data and logs, setting up the database and web investigations in Domain 5.

How it's tested

Expect many fact-recall questions mixed with short interpretation tasks. Items may show a hex header, a log line or a partition layout and ask what it means. Others ask which file system feature, log source or boot stage holds a given piece of evidence. Precise numbers, such as event IDs and sector sizes, appear often.

  • Read the bytes

    A short hex sequence or encoded string is shown and you identify the file type, encoding or hidden content.

  • Find the structure

    A piece of metadata is described and you name the disk or file system structure that stores it, such as the MFT or inode table.

  • Interpret the log

    A Windows event, syslog entry or web server log line is shown and you explain what activity it records.

Reasoning it through

A file named budget.xlsx will not open, and the hex view begins with 25 50 44 46. The question asks what the file really is. XLSX files are ZIP containers starting with 50 4B 03 04, whereas 25 50 44 46 is ASCII for %PDF. The file is a PDF with a changed extension, a common way to hide data.

Sub-domains 5

Official sub-domains from the EC-Council outline, in outline order.

3.1 Understand the fundamental characteristics and types of digital evidenceEvidence types, characteristics and sources across devices and networks.
What it means
This sub-domain defines digital evidence as information stored or transmitted in digital form that can support or refute a claim. It covers volatile versus non-volatile evidence, active, archival and residual (latent) data, user-created versus computer-generated records, and sources such as computers, phones, networks, cloud services and removable media.
What to understand
Admissible evidence must be authentic, complete, reliable, believable and relevant, which is why handling procedures matter as much as content. Residual data, such as deleted files in unallocated space, often holds the most valuable information but needs physical imaging to recover. Computer-generated records, like logs, are treated differently from user-created documents. Evidence is fragile: it can be changed by booting a system, opening a file or simply waiting for logs to roll over.
How it shows up
Questions ask you to classify an item of evidence or identify which characteristic is at risk.
Common confusion
Treating volatile and residual data as the same; residual data persists on disk, volatile data does not.
3.2 Understand the fundamental concepts and working of desktop and mobile Operating SystemsDisks, partitions, boot processes, file systems and mobile OS architecture.
What it means
This sub-domain covers how storage and operating systems hold data: HDD platters, sectors and clusters, SSD behavior including TRIM and wear leveling, MBR and GPT partition schemes, BIOS and UEFI boot sequences for Windows, Linux and macOS, file systems including FAT32, NTFS, ext4, HFS+ and APFS, and the Android and iOS architectures and storage layouts.
What to understand
Slack space arises because files rarely fill their last cluster exactly, and it can contain fragments of older data. On NTFS, the Master File Table holds a record for every file, and small files may be resident inside the MFT itself. ext4 keeps metadata in inodes. TRIM on SSDs can erase deleted blocks quickly, limiting recovery. MBR sits in sector 0 and supports four primary partitions; GPT supports many more and keeps a backup header. Mobile devices often use file-based encryption that complicates acquisition.
How it shows up
Expect questions on where metadata lives, which partition scheme is in use, or why SSD recovery fails.
Common confusion
Assuming deleted data on an SSD is as recoverable as on a hard disk; TRIM and garbage collection often erase it.
3.3 Understand different types of logs and their importance in forensic investigationsWindows, Linux and web server logs, and what makes log evidence admissible.
What it means
This sub-domain covers the main log sources an investigator uses: Windows Security, System and Application event logs stored as EVTX files, Linux syslog and journald, authentication logs, and web server logs from IIS (W3C extended format) and Apache (access and error logs). It also covers log retention, time synchronization and the requirements for logs to be admissible.
What to understand
Logs reconstruct who did what and when, but only if they are complete and their timestamps are trustworthy. Key Windows event IDs include 4624 for successful logon, 4625 for failed logon and 1102 for a cleared security log. IIS logs default to UTC, while Apache often records local time with an offset, which matters when correlating. Admissibility depends on showing logs were generated routinely, protected from tampering and kept under documented policy, ideally centralized with synchronized clocks.
How it shows up
Expect to interpret a log entry, name the event ID for an activity, or spot a time zone problem.
Common confusion
Forgetting that IIS logs use UTC by default while many other sources use local time.
3.4 Understand various encoding standards and analyze various file typesCharacter encodings, hex analysis and file signature identification.
What it means
This sub-domain covers how data is represented: ASCII, Unicode encodings such as UTF-8 and UTF-16, Base64 and hexadecimal. It also covers using a hex editor to inspect files and identifying file types by their signatures (magic numbers) and structure, including image, document, archive and executable formats such as JPEG, PNG, PDF, ZIP-based Office files and Windows PE files.
What to understand
Extensions are easy to change, so investigators trust the header bytes instead. Common signatures include FF D8 FF for JPEG, 89 50 4E 47 for PNG, 25 50 44 46 for PDF, 50 4B 03 04 for ZIP and modern Office files, and 4D 5A (MZ) for Windows executables. Some formats also have footers, which help in file carving. Base64 is encoding, not encryption, and is often used to smuggle data in email or scripts. UTF-16 text shows interleaved zero bytes in a hex view.
How it shows up
Questions present a header in hex or an encoded string and ask what it represents.
Common confusion
Calling Base64 encryption; it is reversible encoding with no key.
3.5 Understand the fundamental working of WAF and MySQL DatabaseHow web application firewalls inspect traffic and how MySQL stores data and logs.
What it means
This sub-domain explains how a web application firewall inspects HTTP traffic using signatures or rules to block attacks such as SQL injection and cross-site scripting, and what its logs record. It also covers MySQL architecture: databases, tables, storage engines such as InnoDB, and data directory files, plus logs such as the general query log, error log, slow query log and binary log.
What to understand
WAF logs show blocked and allowed requests with matched rules, which helps confirm an attack attempt and its source. In MySQL, the binary log records data-changing statements and is valuable for reconstructing what an attacker modified, while the general query log records all statements but is often disabled for performance. InnoDB stores data in tablespace files, and MyISAM uses separate files per table. Knowing which logs are on by default tells you what evidence is likely to exist.
How it shows up
Expect to pick the MySQL log that reveals data changes, or what a WAF log entry indicates.
Common confusion
Assuming the general query log is always enabled; in many deployments it is off by default.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Slack space

    Unused space between the end of a file and the end of its last cluster.

    Remember
    It can hold remnants of earlier files.
    Tested as
    Data recovery questions.
    Trap
    Assuming new files fully overwrite old data.

  • Master File Table (MFT)

    NTFS structure with a record for every file and folder.

    Remember
    Small files can be resident inside their MFT record.
    Tested as
    File system questions.
    Trap
    Looking for small file content only in clusters.

  • MBR vs. GPT

    MBR sits in sector 0 with a four-primary-partition limit; GPT uses GUIDs and a backup header.

    Remember
    GPT is used with UEFI boot.
    Tested as
    Partition scheme questions.
    Trap
    Thinking GPT has no backup copy.

  • TRIM

    SSD command that marks deleted blocks so the drive can erase them.

    Remember
    It sharply limits recovery of deleted data on SSDs.
    Tested as
    SSD forensics questions.
    Trap
    Expecting HDD-style recovery from an SSD.

  • Inode

    Linux ext file system structure holding file metadata and block pointers.

    Remember
    File names are stored in directory entries, not the inode.
    Tested as
    Linux file system questions.
    Trap
    Expecting the file name inside the inode.

  • File signature (magic number)

    Fixed bytes at the start of a file that identify its format.

    Remember
    JPEG FF D8 FF, PDF 25 50 44 46, ZIP 50 4B 03 04, PE 4D 5A.
    Tested as
    File identification questions.
    Trap
    Trusting the extension over the header.

  • Base64

    Encoding that represents binary data as text using 64 characters.

    Remember
    Reversible without a key; often ends with = padding.
    Tested as
    Encoding questions.
    Trap
    Calling it encryption.

  • Windows event IDs

    Numeric identifiers for logged events.

    Remember
    4624 logon success, 4625 logon failure, 4720 account created, 1102 log cleared.
    Tested as
    Log interpretation questions.
    Trap
    Mixing up 4624 and 4625.

  • IIS vs. Apache logs

    IIS uses W3C extended format in UTC; Apache uses common or combined format, often local time.

    Remember
    Normalize time zones before correlation.
    Tested as
    Web log questions.
    Trap
    Assuming all logs share one time zone.

  • MySQL binary log

    Records statements or row changes that modify data.

    Remember
    Useful for reconstructing what was altered and when.
    Tested as
    Database evidence questions.
    Trap
    Confusing it with the error log.

  • Web application firewall (WAF)

    Filters HTTP traffic against rules for web attacks.

    Remember
    Its logs show matched rules, source and request details.
    Tested as
    WAF questions.
    Trap
    Treating it as a network firewall that inspects ports only.

  • Residual data

    Data remaining after deletion, in unallocated or slack space.

    Remember
    Recoverable only with physical imaging.
    Tested as
    Evidence type questions.
    Trap
    Confusing it with volatile data.

  • Bit-stream vs. backup copy

    A bit-stream copy reproduces every sector; a backup copies only active files.

    Remember
    Only a bit-stream copy preserves residual data.
    Tested as
    Evidence collection questions.
    Trap
    Using backup software for forensic acquisition.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

NTFS vs. FAT32 vs. ext4

ConceptMeaningKey differenceCommon trap
NTFS Windows file system with MFT, journaling and ADS Rich metadata and alternate data streams Missing hidden data in ADS
FAT32 Simple table-based file system No journaling, 4 GB file size limit Expecting permissions metadata
ext4 Linux journaling file system with inodes Metadata in inodes, names in directories Expecting an MFT

HDD vs. SSD as evidence

ConceptMeaningKey differenceCommon trap
HDD Magnetic platters with sectors Deleted data persists until overwritten Ignoring slack and unallocated space
SSD Flash memory with a controller TRIM and wear leveling remove deleted data Expecting full deleted-file recovery

ASCII vs. Unicode vs. Base64

ConceptMeaningKey differenceCommon trap
ASCII 7-bit character set for English text One byte per character Missing non-English text
Unicode (UTF-16) Multi-byte encoding for all scripts Interleaved 00 bytes for Latin text Searching only for ASCII strings
Base64 Binary-to-text encoding Reversible with no key Calling it encryption

MySQL logs

ConceptMeaningKey differenceCommon trap
Binary log Data-changing events Reconstructs modifications Thinking it records SELECT queries
General query log Every client statement Most complete but often disabled Assuming it is always on
Error log Startup, shutdown and errors Shows crashes and failed starts Expecting query history in it

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Trust the extension

    What candidates pick
    Identify a file by its name, such as .docx.
    Why it looks right
    Extensions usually match content.
    Why it's wrong
    Extensions are trivial to change; the header signature identifies the real format.

    Clue to watch for A hex header is shown in the question.

  2. SSD like HDD

    What candidates pick
    Plan to carve deleted files from an SSD as on a hard disk.
    Why it looks right
    Both are storage media.
    Why it's wrong
    TRIM and garbage collection often erase deleted blocks on SSDs, so recovery may fail.

    Clue to watch for The device is described as an SSD or flash storage.

  3. Base64 is encryption

    What candidates pick
    Describe Base64 strings as encrypted data needing a key.
    Why it looks right
    The text looks unreadable.
    Why it's wrong
    Base64 is reversible encoding; anyone can decode it without a key.

    Clue to watch for The string uses letters, digits, + and / and ends with =.

  4. Wrong event ID

    What candidates pick
    Choose 4625 for a successful logon.
    Why it looks right
    The numbers are adjacent.
    Why it's wrong
    4624 marks a successful logon; 4625 records a failed one, often used to spot brute force.

    Clue to watch for The question says successful or failed explicitly.

  5. Logs share one clock

    What candidates pick
    Correlate web and system logs as recorded.
    Why it looks right
    Logs look consistently timestamped.
    Why it's wrong
    IIS logs in UTC and other sources in local time can produce a misleading timeline if not normalized.

    Clue to watch for Events appear hours apart that should be simultaneous.

  6. General log has everything

    What candidates pick
    Rely on MySQL's general query log for data changes.
    Why it looks right
    It records all statements.
    Why it's wrong
    It is frequently disabled; the binary log is the usual source for data-changing events.

    Clue to watch for The question asks what records modifications by default.

Answer framework

When a Domain 3 question shows raw data or asks where evidence lives, work through these steps.

  1. Classify the evidence: volatile or non-volatile, active or residual, user-created or computer-generated, since that tells you how it must be collected.
  2. Identify the storage layer: disk type, partition scheme, file system and the structure such as MFT or inode that holds the metadata you need.
  3. For files, read the header bytes and compare them with known signatures before trusting any extension or name.
  4. For logs, identify the source and format, check the time zone, and map identifiers such as event IDs to the activity they record.
  5. For web and database cases, check which WAF and MySQL logs exist and which are enabled by default before assuming the evidence is there.

Practice question

An examiner reviews a Windows Security log during an intrusion case. The log shows dozens of event ID 4625 entries for one account within two minutes, followed by a single event ID 4624. What does this pattern most likely indicate?

Want more like this? The CHFI practice test has questions for every domain.

Checklist

0 of 14

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Split this domain into its five sub-domains and give the operating system and file system material the most time, since it is the densest. Draw an MBR and a GPT disk layout from memory, then sketch where the NTFS MFT, ext4 inodes and slack space sit. Open a small disk image in a free tool such as Autopsy or a hex editor and locate the boot sector yourself.

For logs, make a one-page table of Windows event IDs, Linux log locations, and IIS and Apache formats with their default time zones. Read a few real log lines aloud and say what each records; interpreting a line is what the exam asks.

For encoding and file types, keep a signature card listing about ten common magic numbers and drill it until you can name a format from its first four bytes. Practise decoding Base64 by hand once so the pattern is familiar. End with WAF and MySQL basics, focusing on which logs exist and which are enabled by default.

FAQ

How much of the CHFI exam is Domain 3 Digital Evidence?

Digital Evidence is 17% of CHFI v11 under Blueprint v3, about 26 of the 150 questions across five sub-domains.

Do I need to memorize file signatures?

Yes, at least the common ones: JPEG, PNG, GIF, PDF, ZIP and Office Open XML, and Windows executables. Questions often show header bytes.

Which Windows event IDs come up most?

Logon success 4624, logon failure 4625, account creation 4720, special privileges 4672 and security log cleared 1102 are the core set.

How much mobile OS detail is in this domain?

Architecture and storage concepts for Android and iOS. Acquisition and analysis of mobile devices are covered in later domains and the v11 mobile forensics module.

Why are WAF and MySQL in an evidence domain?

They are common sources of web attack evidence. Knowing how they work and log activity prepares you for the web and database investigations in Domain 5.

Is macOS covered?

Yes. APFS, HFS+ and the macOS boot process appear, and the v11 course pairs Linux and Mac forensics in one module.

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 3 knowledge

Practise reading hex headers, log lines and file system questions in short timed sets before a full CHFI mock exam.

Take the CHFI practice test Check your CHFI readiness

Keep going