Overview
Domain 1 builds the conceptual base for the rest of CHFI. It starts with the kinds of cybercrime an investigator meets, from insider data theft to ransomware, web application attacks and network intrusions, along with indicators of compromise and the challenges that slow cases down, such as encryption, anti-forensics, jurisdiction and data volume. It then defines computer forensics itself: its objectives, when it is used, how it links to incident response and forensic readiness, and what investigators, first responders and expert witnesses are expected to do.
The third sub-domain introduces acquisition theory: live versus dead-box collection, the order of volatility, and image formats such as raw, E01 and AFF. The last one surveys the technologies later domains examine in depth: databases, cloud service models, email flow, IoT architecture, file-based and fileless malware, and the Tor-based dark web. CHFI v11 remains the current version of exam 312-49, with no announced retirement as of October 2026.
How it's tested
Domain 1 questions tend to be short definitions and classifications. You will be asked to name a cybercrime category, place data in volatility order, choose an acquisition format, or match a technology such as a cloud model or an email protocol to a description. A few present a brief case and ask what the investigator should consider first.
-
Classify the crime or indicator
A case is described and you identify whether it is an insider attack, an external intrusion or a specific attack type, or which artifact is an indicator of compromise.
-
Rank by volatility
Several data sources are listed and you choose which should be collected first, using the RFC 3227 order of volatility.
-
Identify the technology
A description of a cloud model, email protocol, IoT layer or malware behavior is given and you name the matching concept.
A question lists a suspect laptop's swap file, CPU cache, an archived backup tape and the current ARP cache, then asks which to capture first. Order of volatility puts registers and CPU cache at the top, followed by routing and ARP tables, memory, temporary file systems, disk and finally archival media. CPU cache is therefore first, even though few tools can capture it in practice.
Sub-domains 4
Official sub-domains from the EC-Council outline, in outline order.
1.1 Understand different types of cybercrimes and list various forensic investigations challengesCybercrime categories, attack types, indicators of compromise and investigation obstacles.
- What it means
- This sub-domain covers how cybercrime is classified (crimes where the computer is the target, the tool, or incidental), insider versus external attacks, common web and network attacks, indicators of compromise, and anti-forensic behavior. It also lists the practical challenges investigators face, including encrypted data, cloud jurisdiction, huge storage volumes and short log retention.
- What to understand
- Classifying the crime tells you where evidence is likely to sit and which laws may apply. Indicators of compromise are artifacts, such as unusual outbound connections, unknown services or changed registry run keys, that suggest a system was breached. Anti-forensics, such as wiping or timestamp changes, is both an attack behavior and an investigation challenge. Cross-border cloud storage raises legal hurdles before any technical work begins.
- How it shows up
- Expect to classify a described incident or pick which artifact counts as an indicator of compromise.
- Common confusion
- Treating every indicator of compromise as proof of an attack; indicators require corroboration before conclusions.
1.2 Understand the fundamentals of computer forensics and determine the roles and responsibilities of forensic investigatorsObjectives of computer forensics, forensic readiness, incident response links and investigator duties.
- What it means
- Computer forensics is the methodical identification, acquisition, preservation, analysis and reporting of digital evidence so it can support legal or internal proceedings. This sub-domain covers why organizations need it, forensic readiness planning, how forensics fits within incident response, and the responsibilities of investigators, first responders and expert witnesses.
- What to understand
- Forensic readiness means preparing logging, policies and tools before an incident so evidence can be collected cheaply and admissibly. Investigators must stay objective, work within their authority, document every action, preserve originals and report findings without overstating them. Incident response aims to contain and recover, while forensics aims to establish facts; the two can conflict when restoring a system would destroy evidence. CHFI v11 also mentions AI-assisted analysis and forensics automation as emerging capabilities.
- How it shows up
- Questions ask what an investigator should or should not do, or what forensic readiness provides.
- Common confusion
- Assuming the investigator should advocate for the client; the role is to report findings impartially.
1.3 Understand data acquisition concepts and rulesLive and dead acquisition, order of volatility, image types and formats, and acquisition rules.
- What it means
- Data acquisition is the process of copying digital evidence in a way that preserves its integrity. The sub-domain covers live acquisition from a running system versus static acquisition from powered-down media, the order of volatility, logical versus physical (bit-stream) copies, sparse acquisition, and image formats such as raw (dd), E01 and AFF.
- What to understand
- Volatile data such as RAM, network connections and running processes disappears at shutdown, so it is captured live and first. A physical image copies every sector, including unallocated space and slack, while a logical copy takes only selected files. Raw images are simple but uncompressed and carry no metadata; E01 adds compression, case metadata and embedded hashes. Rules include working on a verified copy, hashing before and after, and using write blockers on source media.
- How it shows up
- Expect questions on what to collect first, which image type preserves deleted data, and which format stores metadata.
- Common confusion
- Believing a logical copy recovers deleted files; only a physical or bit-stream image captures unallocated space.
1.4 Understand the fundamental concepts and working of databases, cloud computing, Emails, IoT, Malware (file and fileless) and dark webHow the technologies investigated later in CHFI are built and operate.
- What it means
- This sub-domain is a technology primer. It explains database components and transaction logs, cloud service and deployment models with the shared responsibility model, email architecture and protocols, IoT device layers, malware types including fileless malware that lives in memory and scripting engines, and how the dark web and Tor onion routing hide users.
- What to understand
- In cloud forensics, what the investigator can reach depends on the service model: IaaS customers can image virtual machines, while SaaS customers rely on provider logs. Email moves from a mail user agent to a mail transfer agent using SMTP, and is retrieved with POP3 or IMAP. Fileless malware abuses PowerShell, WMI or the registry and may leave little on disk. Tor routes traffic through entry, middle and exit relays, so the destination never sees the original address.
- How it shows up
- Questions test definitions: which cloud model gives access to VM images, which protocol retrieves mail, or what makes malware fileless.
- Common confusion
- Confusing SMTP, which sends and relays mail, with IMAP and POP3, which retrieve it.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
Order of volatility
The sequence for collecting evidence from most to least short-lived, described in RFC 3227.
- Remember
- Registers and cache, then routing and ARP tables, memory, temporary files, disk, remote logs, archives.
- Tested as
- Collection-priority questions.
- Trap
- Imaging the disk before capturing RAM.
-
Indicator of compromise (IoC)
An observable artifact suggesting a system has been breached.
- Remember
- Examples include unusual outbound traffic, unknown processes and altered run keys.
- Tested as
- Identification questions.
- Trap
- Treating a single IoC as conclusive proof.
-
Forensic readiness
Preparation that lets an organization collect admissible evidence quickly at low cost.
- Remember
- It includes logging policy, retention, tools and trained staff before an incident.
- Tested as
- Concept and planning questions.
- Trap
- Confusing it with incident response, which happens after the event.
-
Physical vs. logical acquisition
A physical image copies every sector; a logical copy takes selected files or partitions.
- Remember
- Only physical imaging captures unallocated space and slack.
- Tested as
- Acquisition choice questions.
- Trap
- Expecting deleted files in a logical copy.
-
E01 (Expert Witness Format)
An image format with compression, case metadata and embedded hash values.
- Remember
- Raw dd images have no metadata or compression.
- Tested as
- Format questions.
- Trap
- Assuming raw images store case notes.
-
Live acquisition
Collecting data from a running system.
- Remember
- Required for RAM, network state and encrypted volumes that are currently mounted.
- Tested as
- Scenario questions about powered-on systems.
- Trap
- Pulling the plug before capturing volatile data.
-
Shared responsibility model
The split of security and data duties between cloud provider and customer.
- Remember
- Investigator access shrinks from IaaS to PaaS to SaaS.
- Tested as
- Cloud forensics scope questions.
- Trap
- Expecting to image a SaaS provider's servers.
-
Fileless malware
Malicious code that runs in memory or through legitimate tools such as PowerShell and WMI.
- Remember
- Memory and registry analysis matter more than disk file scanning.
- Tested as
- Malware classification questions.
- Trap
- Assuming antivirus file scans will find it.
-
Tor and onion routing
Layered encryption across relays that hides the source and destination of traffic.
- Remember
- Onion services use .onion addresses reachable only through Tor.
- Tested as
- Dark web questions.
- Trap
- Thinking the exit relay knows the user's IP address.
-
SMTP, POP3 and IMAP
SMTP sends and relays mail; POP3 downloads it; IMAP synchronizes it on the server.
- Remember
- IMAP leaves mail on the server, POP3 usually removes it.
- Tested as
- Email fundamentals questions.
- Trap
- Naming SMTP as a retrieval protocol.
-
Insider vs. external attack
Attacks by people with authorized access versus those from outside the organization.
- Remember
- Insiders often leave evidence in access logs, USB history and email.
- Tested as
- Crime classification questions.
- Trap
- Assuming insiders need exploits to steal data.
-
Expert witness
A qualified person who gives opinion testimony on technical findings.
- Remember
- Opinions must rest on documented, repeatable methods.
- Tested as
- Role questions.
- Trap
- Confusing an expert witness with a fact witness.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Live vs. static (dead) acquisition
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Live acquisition | Collect from a powered-on system | Captures RAM, connections and mounted encrypted volumes | Forgetting it changes system state slightly |
| Static acquisition | Image media from a powered-off system | Repeatable and minimal change to the source | Using it first and losing volatile data |
Raw vs. E01 vs. AFF image formats
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Raw (dd) | Plain sector-by-sector copy | Universal but no compression or metadata | Assuming it embeds a hash |
| E01 | EnCase Expert Witness Format | Compression, metadata and CRC/hash checks | Thinking it is readable only by one vendor |
| AFF | Advanced Forensic Format, open standard | Open format with metadata support | Confusing it with the AFF4 container |
Cloud service models and investigator access
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| IaaS | Customer manages OS and apps on provider infrastructure | Customer can snapshot or image VMs | Expecting hypervisor logs by default |
| PaaS | Customer deploys code on a managed platform | Access to app logs, not the OS | Planning a full disk image |
| SaaS | Provider runs the whole application | Evidence mostly from provider logs and exports | Assuming direct server access |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Shut it down first
- What candidates pick
- Power off a running suspect machine immediately to stop damage.
- Why it looks right
- It seems to freeze the evidence in place.
- Why it's wrong
- Shutting down destroys RAM, network connections and possibly access to mounted encrypted volumes that must be captured live.
Clue to watch for The system is described as running or logged in.
-
Logical is enough
- What candidates pick
- Choose a logical file copy for a case involving deleted data.
- Why it looks right
- It is faster and smaller.
- Why it's wrong
- A logical copy omits unallocated space and slack, which is exactly where deleted data sits.
Clue to watch for The case mentions deleted, wiped or hidden files.
-
Disk before memory
- What candidates pick
- Rank the hard disk above RAM in collection order.
- Why it looks right
- The disk holds most of the data.
- Why it's wrong
- Volume of data does not set priority; volatility does, and RAM is lost at power-off while the disk persists.
Clue to watch for The question asks what to collect first.
-
SaaS imaging
- What candidates pick
- Plan to image the provider's servers in a SaaS investigation.
- Why it looks right
- Imaging is the standard forensic approach.
- Why it's wrong
- In SaaS the customer controls no infrastructure, so evidence comes from provider logs, exports and legal requests.
Clue to watch for The service is a hosted application such as webmail or a CRM.
-
IoC equals proof
- What candidates pick
- Conclude a breach occurred from one suspicious artifact.
- Why it looks right
- IoCs are designed to signal compromise.
- Why it's wrong
- An indicator needs corroboration from other evidence before it supports a finding.
Clue to watch for The answer options include verifying with additional sources.
-
Fileless means traceless
- What candidates pick
- Assume fileless malware leaves no evidence at all.
- Why it looks right
- The name suggests nothing is written to disk.
- Why it's wrong
- It often leaves traces in memory, registry keys, WMI subscriptions, prefetch and event logs.
Clue to watch for The question asks where to look for fileless malware.
Answer framework
Use these steps on Domain 1 questions to reach the investigator's answer rather than the administrator's.
- Classify the incident first: insider or external, computer as target or as tool, and which attack type, because that predicts where evidence lives.
- Check whether the system is running, and if so plan live collection of volatile data before anything that changes or powers off the machine.
- Apply the order of volatility from RFC 3227 to rank sources, starting with cache and memory and ending with archival media.
- Choose physical imaging and a format with integrity checks when deleted data or court use is possible, and verify hashes before and after.
- For cloud, email, IoT or dark web cases, identify which party actually holds the data and what access the service model gives you.
Practice question
Want more like this? The CHFI practice test has questions for every domain.
Checklist
0 of 14
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Start with vocabulary. Write a one-line definition for each cybercrime category, each indicator of compromise type and each investigator role, because Domain 1 questions often hinge on a single word. Then memorize the RFC 3227 order of volatility until you can rank any mixed list quickly; this pays off again in Domain 4.
Next, study acquisition theory with a hands-on angle. If you can, create a raw image and an E01 image of a USB stick with free tools, compare their sizes and look at the metadata each format keeps. Seeing that a logical copy omits deleted files is more memorable than reading it.
Finish with the technology primer in sub-domain 1.4. Draw the email path from sender to recipient, sketch IaaS, PaaS and SaaS with who controls each layer, and list where fileless malware hides. Keep these notes short, because the deeper analysis comes in Domains 4 and 5. Since this is the heaviest domain at 18%, aim for consistent accuracy here before moving on.
FAQ
How much of the CHFI exam is Domain 1 Forensic Science?
Forensic Science is 18% of CHFI v11 under Blueprint v3, the largest single domain, which works out to about 27 of the 150 questions.
Do I need to memorize RFC 3227?
You do not need the document itself, but you should know its order of volatility, since CHFI asks which source to collect first.
Is the CHFI passing score fixed?
No. EC-Council sets a cut score per exam form, which it describes as between 60% and 85%, so aim well above the lower end.
How deep does Domain 1 go on cloud and IoT?
It stays at the level of concepts: service models, shared responsibility and IoT architecture. Investigation steps for these environments sit in Domains 4, 5 and 6.
What is the difference between incident response and forensics?
Incident response focuses on containing and recovering from an incident. Forensics focuses on establishing what happened with evidence that can withstand legal scrutiny. CHFI expects the forensic mindset.
Does CHFI v11 cover AI?
The v11 course introduces the role of AI and automation in computer forensics in its first module. Treat it as background knowledge rather than a major exam topic.
Is CHFI v11 still the current version?
Yes. As of October 2026, EC-Council lists CHFI v11 with exam code 312-49 and has not announced a retirement date.
Other Cybersecurity certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
- CompTIA Cybersecurity Analyst+ Study guide
- Microsoft Security Operations Analyst Associate Study guide
- Certified Ethical Hacker Study guide
- Penetration Tester Study guide
- Systems Security Certified Practitioner Study guide
- Certified in Risk and Information Systems Control Study guide
- CompTIA PenTest+ Study guide
- CompTIA SecurityX (CASP+) Study guide
- Azure Security Engineer Associate Study guide
- CISM (Certified Information Security Manager) Study guide
- CISSP Study guide
- CompTIA Security+ Study guide
- Certified Information Systems Auditor Study guide
- Certified Cloud Security Professional Study guide
Test your Domain 1 knowledge
Practise classifying cybercrimes, ranking evidence by volatility and choosing acquisition formats in short timed question sets before a full mock exam.