Overview
Domain 4 is the how-to domain of CHFI. Its first sub-domain walks through the forensic investigation process in three broad phases: pre-investigation (building a forensic lab, team and tool kit), investigation (first response, securing the scene, collecting, preserving and analyzing evidence) and post-investigation (writing the report and testifying as an expert witness).
The second sub-domain covers acquisition methodology: deciding on live or static acquisition, using write blockers, choosing the image format, validating with hashes, and handling special cases such as RAID arrays, encrypted volumes and databases. The third covers examining images, including Windows memory and registry analysis, Autopsy and The Sleuth Kit, and correlating events across sources into a timeline. The fourth sets out the methods for dark web forensics, finding Tor Browser artifacts on a suspect machine, and for malware forensics, including preparing a safe analysis lab. Domain 5 then applies these methods to specific environments.
How it's tested
Domain 4 questions are usually sequence and next-step items. You are placed at a stage of an investigation and asked what comes next, what was done wrong, or which method fits the evidence. Some ask where in memory or the registry a specific artifact is found, or which tool performs a step.
-
What comes next
A partial investigation is described and you choose the next correct step in EC-Council's process.
-
Pick the acquisition method
A device, its state and constraints are described, and you choose the acquisition approach, tool type or validation step.
-
Where is the artifact
An activity such as running Tor Browser or launching a program is named and you identify the memory, registry or file location that records it.
A first responder photographs a running server, notes connected cables and identifies volatile data to collect. The question asks what should happen next. Collecting volatile data comes before shutdown, but the scene must be secured and documented first, which has already happened. So the correct next step is live collection of memory and network state using trusted tools from external media.
Sub-domains 4
Official sub-domains from the EC-Council outline, in outline order.
4.1 Understand Forensic Investigation ProcessPre-investigation, investigation and post-investigation phases, lab setup, first response and reporting.
- What it means
- This sub-domain describes EC-Council's investigation model. Pre-investigation covers building a forensic workstation and lab, assembling the team, getting approval and planning. Investigation covers first response, securing and documenting the scene, collecting, preserving, imaging and analyzing evidence. Post-investigation covers writing a forensic report and testifying as an expert witness.
- What to understand
- Each phase exists to protect evidence integrity and admissibility. First responders secure the scene, photograph and document the setup, and avoid changing systems unnecessarily. Evidence is packaged, labeled and transported with a chain of custody record. The forensic lab needs physical security, controlled access and validated tools. The report should be clear, objective and reproducible, stating methods, findings and limits, and should be written for a non-technical reader where needed.
- How it shows up
- Expect next-step questions and items on what a first responder or report should include.
- Common confusion
- Analyzing evidence before it is imaged and hash-verified; preservation always precedes analysis.
4.2 Understand the methodology to acquire data from different types of evidenceSteps for live and static acquisition, write blocking, validation and special cases.
- What it means
- This sub-domain covers the full acquisition workflow: deciding on live or static acquisition, choosing the method (disk-to-image, disk-to-disk, logical or sparse), sanitizing target media, using hardware or software write blockers, acquiring volatile data with trusted tools, imaging non-volatile media, validating with hash values, and handling RAID, encrypted disks and database evidence.
- What to understand
- Volatile data is collected first using tools run from trusted external media so the suspect system's binaries are not relied on. Target drives should be forensically wiped before use to avoid cross-contamination. Hashes, typically MD5 and SHA-1 or SHA-256, are calculated on source and image to prove they match. Encrypted volumes may require live acquisition while unlocked. RAID arrays are often best imaged as the logical volume or as individual disks with the controller configuration recorded.
- How it shows up
- Questions test acquisition order, the purpose of write blockers, and how to validate an image.
- Common confusion
- Thinking a write blocker protects against changes made during live acquisition; it only protects attached storage.
4.3 Illustrate Image/Evidence Examination and Event CorrelationExamining images, Windows memory and registry analysis, Autopsy and TSK, and timeline correlation.
- What it means
- This sub-domain covers how an acquired image is examined: mounting it read-only, file carving, keyword searches, Windows memory analysis for processes and network connections, Windows registry analysis of hives such as SAM, SYSTEM, SOFTWARE and NTUSER.DAT, using Autopsy and The Sleuth Kit, and correlating events from multiple sources into a single timeline.
- What to understand
- Memory analysis reveals running and hidden processes, injected code, open connections and sometimes decryption keys. Registry hives record user accounts, installed software, USB devices, recently used files and autostart locations. Event correlation links entries from different logs and systems by time, host, user or IP, which requires normalized timestamps. Correlation can be same-platform or cross-platform, and rule-based or statistical. Autopsy is a graphical front end to The Sleuth Kit command-line tools.
- How it shows up
- Expect questions on which registry hive holds an artifact and on the purpose and types of event correlation.
- Common confusion
- Looking for user-specific activity in the SYSTEM hive; per-user data lives in NTUSER.DAT.
4.4 Explain Dark Web and Malware ForensicsTor artifact investigation and the methodology for malware forensics.
- What it means
- This sub-domain explains how to investigate dark web use, mainly through Tor Browser artifacts on a suspect's machine, and how to approach malware forensics. It covers where Tor leaves traces in memory, prefetch, the registry and browser files, and the setup of a malware analysis lab with isolated virtual machines and the steps of static and dynamic analysis.
- What to understand
- Tor Browser keeps little history by design, but memory captured while it runs may contain visited onion addresses, and prefetch and registry entries can prove it was executed. If the browser is closed, evidence shrinks sharply, which is another reason for live capture. Malware analysis must run in an isolated lab with snapshots, no production network access and controlled internet simulation. Static analysis examines the file without running it; dynamic analysis observes its behavior in a sandbox.
- How it shows up
- Questions ask where Tor use can be proven and how to set up a safe malware analysis environment.
- Common confusion
- Expecting Tor Browser history in the usual browser databases; it is intentionally not kept.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
Three investigation phases
Pre-investigation, investigation and post-investigation.
- Remember
- Lab, team and approvals come before any evidence handling.
- Tested as
- Process sequence questions.
- Trap
- Starting with analysis before preparation.
-
First responder duties
Secure the scene, document it, identify and preserve evidence.
- Remember
- Photograph screens, cables and the room before touching anything.
- Tested as
- First response questions.
- Trap
- Exploring the suspect system to look for evidence.
-
Write blocker
Hardware or software that prevents writes to attached evidence media.
- Remember
- It does not stop changes during live acquisition of a running system.
- Tested as
- Acquisition questions.
- Trap
- Thinking it makes live response risk-free.
-
Hash validation
Computing hashes on source and image to prove they match.
- Remember
- Use at least one strong algorithm such as SHA-256, often alongside MD5.
- Tested as
- Image validation questions.
- Trap
- Hashing only the image and not the source.
-
Sanitizing target media
Wiping the destination drive before imaging.
- Remember
- Prevents leftover data contaminating the new image.
- Tested as
- Lab procedure questions.
- Trap
- Imaging onto a used drive without wiping.
-
Windows registry hives
SAM, SECURITY, SYSTEM, SOFTWARE and per-user NTUSER.DAT.
- Remember
- USB history sits in SYSTEM; user activity sits in NTUSER.DAT.
- Tested as
- Artifact location questions.
- Trap
- Looking for user activity in SAM.
-
Memory forensics
Analysis of a RAM capture for processes, connections and injected code.
- Remember
- It finds fileless malware and hidden processes disk analysis misses.
- Tested as
- Live analysis questions.
- Trap
- Relying only on Task Manager output.
-
Event correlation
Linking related events from multiple logs or systems.
- Remember
- Same-platform and cross-platform; rule-based or statistical approaches.
- Tested as
- Correlation questions.
- Trap
- Correlating without normalizing time zones.
-
Timeline analysis
Ordering file system, log and registry events by time.
- Remember
- MAC times and log timestamps combine into one view.
- Tested as
- Reconstruction questions.
- Trap
- Ignoring that timestamps can be altered.
-
Autopsy and The Sleuth Kit
Open-source disk analysis platform and its underlying command-line tools.
- Remember
- Autopsy is the graphical interface to TSK.
- Tested as
- Tool identification questions.
- Trap
- Treating them as memory analysis tools.
-
Tor Browser artifacts
Traces of Tor use in memory, prefetch, registry and installation folders.
- Remember
- Live memory gives the richest evidence.
- Tested as
- Dark web questions.
- Trap
- Expecting full browsing history on disk.
-
Malware analysis lab
Isolated environment with VMs, snapshots and simulated network services.
- Remember
- Never analyze malware on a production or internet-connected host.
- Tested as
- Lab setup questions.
- Trap
- Running samples on the examiner's workstation.
-
Forensic report
Document stating scope, methods, findings and conclusions.
- Remember
- It must be objective and reproducible by another examiner.
- Tested as
- Post-investigation questions.
- Trap
- Including opinions unsupported by evidence.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Investigation phases
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Pre-investigation | Lab, tools, team, approvals and planning | Happens before the incident response begins | Skipping tool validation |
| Investigation | First response, collection, preservation, analysis | Where evidence is handled | Analyzing before imaging |
| Post-investigation | Reporting and expert testimony | Communicates findings | Writing an advocacy report |
Static vs. dynamic malware analysis
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Static analysis | Examine the file without running it | Hashes, strings, PE headers, imports | Missing packed or obfuscated behavior |
| Dynamic analysis | Run the sample in a sandbox and observe | Shows process, file, registry and network activity | Running it outside isolation |
Registry hives and what they record
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| SAM | Local user accounts and password hashes | Account information | Looking here for browsing activity |
| SYSTEM | Hardware, services, USB devices, time zone | System-wide configuration | Expecting per-user activity |
| SOFTWARE | Installed programs and OS version | Machine-wide software settings | Confusing with user run keys |
| NTUSER.DAT | Per-user settings, recent files, UserAssist | Ties activity to one user | Overlooking it for user attribution |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Analyze first
- What candidates pick
- Start reviewing files on the seized drive to save time.
- Why it looks right
- It seems efficient.
- Why it's wrong
- Evidence must be imaged and hash-verified before analysis, or its integrity can be challenged.
Clue to watch for No image or hash has been mentioned yet.
-
Write blocker for live systems
- What candidates pick
- Attach a write blocker to protect a running computer during memory capture.
- Why it looks right
- Write blockers prevent changes.
- Why it's wrong
- Write blockers protect attached storage media; live acquisition always alters some state, which must be documented and minimized.
Clue to watch for The system is powered on.
-
Trust the suspect's tools
- What candidates pick
- Use utilities already installed on the suspect machine to collect data.
- Why it looks right
- They are convenient and available.
- Why it's wrong
- Local binaries may be compromised or replaced by rootkits; trusted tools should run from external media.
Clue to watch for The scenario involves possible malware.
-
Single hash enough on image
- What candidates pick
- Hash only the finished image file.
- Why it looks right
- The image is what will be analyzed.
- Why it's wrong
- Integrity is proven by matching hashes of the source and the image, so both must be computed.
Clue to watch for The question asks how to validate an acquisition.
-
Tor leaves history
- What candidates pick
- Search Tor Browser's history database for visited sites.
- Why it looks right
- Other browsers keep detailed history.
- Why it's wrong
- Tor Browser is designed not to retain history, so memory, prefetch and registry artifacts are the main sources.
Clue to watch for The suspect is known to use Tor.
-
Report as advocate
- What candidates pick
- Write conclusions that support the client's position.
- Why it looks right
- The client commissioned the work.
- Why it's wrong
- Forensic reports must be objective and reproducible, stating limits and alternative explanations where relevant.
Clue to watch for The question asks what a report should include.
Answer framework
For Domain 4 sequence questions, locate the stage first, then apply these checks.
- Identify which phase you are in: pre-investigation preparation, investigation with evidence handling, or post-investigation reporting and testimony.
- If evidence is being handled, confirm the scene is secured and documented before anything is touched or collected.
- For acquisition, collect volatile data first with trusted external tools, then image non-volatile media through a write blocker onto sanitized media.
- Validate every acquisition by comparing source and image hashes, and only then begin examination on the verified copy.
- During examination, use the right artifact source, such as a registry hive, memory capture or Tor trace, and correlate events on a normalized timeline before concluding.
Practice question
Want more like this? The CHFI practice test has questions for every domain.
Checklist
0 of 14
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Learn the process model as a sequence you can recite. Write the three phases with their steps on one card, and test yourself by picking a random step and naming what comes immediately before and after it. Many Domain 4 questions are just that check in scenario form.
Then practise acquisition end to end if you can: capture memory from a test virtual machine with a free tool, image a small disk with a write blocker or a software equivalent, and verify the hashes. Doing it once makes the order stick.
Next, spend time on examination artifacts. Load a sample image in Autopsy, find the registry hives, and look up USB history, recent documents and run keys. Make a short table mapping hives to artifacts. For correlation, build a mini timeline from two log sources with different time zones and see the error before normalizing.
Finish with Tor and malware lab setup. These are short topics but produce precise questions about where evidence lives and how isolation is achieved.
FAQ
How much of the CHFI exam is Domain 4 Procedures and Methodology?
Procedures and Methodology is 17% of CHFI v11 under Blueprint v3, about 25 of the 150 questions across four sub-domains.
What are EC-Council's investigation phases?
Pre-investigation, investigation and post-investigation. Preparation and approvals come first, then evidence handling and analysis, then reporting and testimony.
Which hash algorithms should I know?
MD5 and SHA-1 still appear in tools and older procedures, but SHA-256 is preferred. Many examiners record two hashes for each image.
Is memory analysis tested here or in Domain 5?
Both. This domain covers the method and where artifacts sit; Domain 5 applies it to malware and specific operating systems.
Do I need to know Volatility commands?
Know what memory analysis tools such as Volatility do and what they reveal. Exact plug-in syntax is unlikely to be the focus.
How is dark web forensics investigated if Tor hides traffic?
Investigators focus on the suspect's device: memory captured while Tor runs, prefetch files, registry entries and the browser's installation folder.
What makes a forensic report acceptable?
It is objective, complete and reproducible. It states scope, evidence, methods, tools, findings and limitations in language the reader can follow.
Other Cybersecurity certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
- CompTIA Cybersecurity Analyst+ Study guide
- Microsoft Security Operations Analyst Associate Study guide
- Certified Ethical Hacker Study guide
- Penetration Tester Study guide
- Systems Security Certified Practitioner Study guide
- Certified in Risk and Information Systems Control Study guide
- CompTIA PenTest+ Study guide
- CompTIA SecurityX (CASP+) Study guide
- Azure Security Engineer Associate Study guide
- CISM (Certified Information Security Manager) Study guide
- CISSP Study guide
- CompTIA Security+ Study guide
- Certified Information Systems Auditor Study guide
- Certified Cloud Security Professional Study guide
Test your Domain 4 knowledge
Practise next-step and acquisition questions in short timed sets, then confirm you can recite the investigation phases in order.