CHFI · Domain 6 of 6

CHFI Domain 6: Tools/Systems/Programs

Tools/Systems/Programs is 16% of CHFI v11 in two sub-domains: choosing tools to investigate Windows, Linux, Mac, Android and iOS, and tools for MSSQL, MySQL, Azure, AWS, email and IoT evidence. The focus is matching each tool to its job.

Exam weight
16%
Official sub-domains
2
Estimated questions estimate
~24
Suggested study time estimate
12–16 hrs

About 11 min read Reviewed October 2026

Overview

Domain 6 asks which tool fits which task. The first sub-domain covers operating system and device tools: imaging tools such as FTK Imager and dc3dd, suites such as Autopsy, EnCase, X-Ways and Magnet AXIOM, memory tools such as Volatility and LiME, registry and artifact parsers such as RegRipper, Registry Explorer and KAPE, timeline tools such as Plaso, and mobile tools such as ADB, Cellebrite UFED and libimobiledevice for Android and iOS.

The second sub-domain covers environments beyond the endpoint. For databases, it includes SQL Server Management Studio and transaction log readers such as ApexSQL Log for MSSQL, and mysqlbinlog for MySQL. For cloud, it covers AWS CloudTrail, CloudWatch and GuardDuty, and Azure Monitor, Microsoft Sentinel and Microsoft Defender for Cloud. Email tools include header analyzers and mailbox parsers, and IoT tools include Wireshark and firmware extraction utilities such as Binwalk. The exam rarely needs syntax, but it does expect you to know each tool's purpose and limits.

How it's tested

Tool questions take two main forms: given a task, pick the tool; or given a tool, state what it does. Some add a constraint, such as an iPhone instead of an Android phone or a cloud workload instead of a laptop. Distractors are usually real tools from the wrong category, so category knowledge decides most items.

  • Task to tool

    A forensic task such as capturing Linux memory or reading an MSSQL transaction log is described and you choose the tool that performs it.

  • Tool to purpose

    A tool name is given and you identify its main function, such as imaging, memory analysis or timeline building.

  • Platform constraint

    The device or service is specified, such as iOS, macOS or Azure, and you rule out tools that do not support it.

Reasoning it through

A question asks for a tool to analyze a RAM capture taken from a Windows server for injected code. Options include FTK Imager, Volatility, dc3dd and Wireshark. FTK Imager and dc3dd acquire images, and Wireshark analyzes packets. Only Volatility parses memory images for processes, injected code and network structures, so it is the correct choice.

Sub-domains 2

Official sub-domains from the EC-Council outline, in outline order.

6.1 Identify various tools to investigate Operating Systems including Windows, Linux, Mac, Android and iOSAcquisition, analysis, memory and mobile tools for desktop and mobile platforms.
What it means
This sub-domain covers the tools used across desktop and mobile platforms. It includes disk imaging (FTK Imager, dd, dcfldd, dc3dd), full suites (Autopsy, EnCase, X-Ways Forensics, Magnet AXIOM), memory acquisition and analysis (Belkasoft RAM Capturer, LiME, Volatility), Windows artifact parsers (RegRipper, Registry Explorer, KAPE, Event Log Explorer), timeline tools (Plaso), and mobile tools (ADB, Cellebrite UFED, libimobiledevice, Elcomsoft iOS Forensic Toolkit).
What to understand
Group tools by job, not vendor. Acquisition tools copy evidence; analysis suites parse and search it; memory tools are split into capture tools and analysis frameworks. LiME captures Linux memory, while Volatility analyzes captures from Windows, Linux and macOS. Android extraction may be logical through ADB backups or physical with commercial tools. iOS acquisition is often a logical or full file system extraction, frequently dependent on device model and passcode state. macOS work needs APFS-aware tools.
How it shows up
Expect to choose the correct tool for a task on a named platform, or name what a listed tool does.
Common confusion
Confusing memory capture tools with memory analysis frameworks; Volatility analyzes, it does not capture.
6.2 Determine the various tools to investigate MSSQL, MySQL, Azure, AWS, Emails and IoT devicesTools and services for database, cloud, email and IoT investigations.
What it means
This sub-domain covers tools beyond the endpoint. For MSSQL, it includes SQL Server Management Studio, the fn_dblog function and transaction log readers such as ApexSQL Log. For MySQL, mysqlbinlog reads binary logs. For AWS and Azure, it covers native logging and security services. It also covers email header analyzers and mailbox parsers, and IoT tools for traffic capture and firmware extraction.
What to understand
Database tools focus on transaction and binary logs because they show what changed. In AWS, CloudTrail records API calls, CloudWatch collects logs and metrics, and GuardDuty raises threat findings; disk evidence comes from EBS snapshots. In Azure, Azure Monitor and Log Analytics collect logs, Microsoft Sentinel correlates them, and Microsoft Defender for Cloud raises alerts; managed disk snapshots preserve VMs. Email tools parse PST, OST and MBOX files. IoT tools capture network traffic and extract firmware for analysis.
How it shows up
Questions name a database, cloud or email task and ask which tool or service provides the evidence.
Common confusion
Treating GuardDuty or Defender alerts as the raw audit log; they are findings built on other logs.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • FTK Imager

    Free tool for creating and previewing forensic images and capturing memory.

    Remember
    Supports raw and E01 output and hash verification.
    Tested as
    Acquisition tool questions.
    Trap
    Calling it a full analysis suite.

  • dd, dcfldd and dc3dd

    Command-line bit-stream imaging tools.

    Remember
    dcfldd and dc3dd add hashing and progress reporting.
    Tested as
    Linux imaging questions.
    Trap
    Assuming plain dd hashes automatically.

  • Autopsy and EnCase

    Full forensic suites for examining disk images.

    Remember
    Autopsy is open source; EnCase is commercial and created the E01 format.
    Tested as
    Suite identification questions.
    Trap
    Treating them as memory capture tools.

  • Volatility

    Open-source framework for analyzing memory images.

    Remember
    Analyzes captures; it does not acquire memory.
    Tested as
    Memory analysis questions.
    Trap
    Choosing it to capture RAM.

  • LiME

    Linux kernel module for memory acquisition.

    Remember
    Used for Linux and Android memory capture.
    Tested as
    Linux memory questions.
    Trap
    Using it on Windows.

  • RegRipper and Registry Explorer

    Tools that parse Windows registry hives.

    Remember
    Extract USB history, run keys and user activity.
    Tested as
    Registry tool questions.
    Trap
    Using them on live memory.

  • KAPE

    Triage tool that collects and processes key Windows artifacts quickly.

    Remember
    Targets gather files; modules parse them.
    Tested as
    Triage questions.
    Trap
    Thinking it produces a full disk image.

  • Plaso (log2timeline)

    Builds super timelines from many artifact sources.

    Remember
    Combines file system, log and registry timestamps.
    Tested as
    Timeline tool questions.
    Trap
    Confusing it with a log collector.

  • ADB and Cellebrite UFED

    Android Debug Bridge and a commercial mobile extraction platform.

    Remember
    ADB needs USB debugging; UFED supports many devices and extraction types.
    Tested as
    Mobile tool questions.
    Trap
    Using ADB on iPhones.

  • libimobiledevice

    Open-source tools for communicating with iOS devices.

    Remember
    Supports logical backups and device information.
    Tested as
    iOS tool questions.
    Trap
    Treating it as an Android tool.

  • ApexSQL Log and fn_dblog

    Ways to read MSSQL transaction log contents.

    Remember
    They reveal inserts, updates and deletes.
    Tested as
    Database forensics questions.
    Trap
    Using mysqlbinlog for MSSQL.

  • mysqlbinlog

    Utility that reads MySQL binary log files.

    Remember
    Shows data-changing statements with timestamps.
    Tested as
    MySQL forensics questions.
    Trap
    Expecting it to read error logs.

  • AWS CloudTrail, CloudWatch and GuardDuty

    API audit logs, log and metric collection, and threat detection.

    Remember
    CloudTrail is the audit trail; GuardDuty produces findings.
    Tested as
    AWS tool questions.
    Trap
    Treating GuardDuty as the audit log.

  • Azure Monitor, Microsoft Sentinel and Defender for Cloud

    Log collection, SIEM correlation and cloud security alerts.

    Remember
    Log Analytics workspaces store the data Sentinel queries.
    Tested as
    Azure tool questions.
    Trap
    Using old product names as distinct tools.

  • Binwalk

    Tool that analyzes and extracts firmware images.

    Remember
    Used in IoT forensics to examine device file systems.
    Tested as
    IoT tool questions.
    Trap
    Calling it a network capture tool.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Memory acquisition vs. memory analysis tools

ConceptMeaningKey differenceCommon trap
Belkasoft RAM Capturer / FTK Imager Capture Windows RAM to a file Acquisition only Expecting process analysis
LiME Capture Linux and Android memory Kernel module acquisition Using it on Windows
Volatility Analyze memory images Parses processes, connections, injected code Choosing it to capture RAM

Android vs. iOS acquisition tools

ConceptMeaningKey differenceCommon trap
ADB Android Debug Bridge for logical access Requires USB debugging enabled Using it on iOS
libimobiledevice Open-source iOS communication and backups iOS logical acquisition Using it on Android
Cellebrite UFED Commercial multi-platform extraction Supports both platforms and deeper extraction types Assuming it bypasses every lock

AWS vs. Azure evidence services

ConceptMeaningKey differenceCommon trap
AWS CloudTrail Audit of API activity Equivalent role to Azure Activity Log Looking for network flows
AWS GuardDuty Threat detection findings Comparable to Defender for Cloud alerts Treating findings as raw logs
Azure Monitor and Log Analytics Log and metric collection Feeds Microsoft Sentinel Confusing collection with correlation
Microsoft Sentinel Cloud SIEM and SOAR Correlates and hunts across logs Expecting it to snapshot disks

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Volatility captures RAM

    What candidates pick
    Choose Volatility to acquire memory from a running host.
    Why it looks right
    It is the best-known memory tool.
    Why it's wrong
    Volatility analyzes memory images; a capture tool such as FTK Imager, Belkasoft RAM Capturer or LiME must acquire them first.

    Clue to watch for The task is to capture or dump memory.

  2. ADB for iPhone

    What candidates pick
    Use ADB to extract data from an iPhone.
    Why it looks right
    ADB is a familiar mobile tool.
    Why it's wrong
    ADB works only with Android; iOS needs tools such as libimobiledevice or commercial extraction platforms.

    Clue to watch for The device is an iPhone or iPad.

  3. Imaging tool as analyzer

    What candidates pick
    Pick FTK Imager to carve files and build timelines.
    Why it looks right
    It opens and previews images.
    Why it's wrong
    FTK Imager is mainly for acquisition and preview; analysis suites and timeline tools do the deeper work.

    Clue to watch for The task involves searching, carving or timelines.

  4. Wrong database log tool

    What candidates pick
    Use mysqlbinlog to review an MSSQL attack.
    Why it looks right
    Both are SQL databases.
    Why it's wrong
    mysqlbinlog reads MySQL binary logs only; MSSQL transaction logs need fn_dblog or a reader such as ApexSQL Log.

    Clue to watch for The database is identified as SQL Server.

  5. GuardDuty as audit trail

    What candidates pick
    Cite GuardDuty to show which user deleted an S3 bucket.
    Why it looks right
    It is an AWS security service.
    Why it's wrong
    GuardDuty produces threat findings; the authoritative record of API calls such as DeleteBucket is CloudTrail.

    Clue to watch for The question asks who performed an action.

  6. Wireshark for firmware

    What candidates pick
    Choose Wireshark to examine an IoT device's firmware.
    Why it looks right
    Wireshark is a common IoT tool.
    Why it's wrong
    Wireshark captures network traffic; firmware analysis uses extraction tools such as Binwalk.

    Clue to watch for The evidence is a firmware image, not traffic.

Answer framework

For Domain 6 tool questions, narrow the options by function and platform before recalling names.

  1. Identify the platform or service in the question: Windows, Linux, macOS, Android, iOS, MSSQL, MySQL, AWS, Azure, email or IoT.
  2. Identify the task category: acquisition, memory capture, memory analysis, artifact parsing, timeline building, log reading, alerting or reporting, since CHFI groups many tools by investigation phase.
  3. Eliminate tools from the wrong category, such as imaging tools offered for analysis or analysis frameworks offered for capture.
  4. Eliminate tools that do not support the platform, such as Android-only utilities for iOS or MySQL tools for SQL Server.
  5. Choose the remaining tool that produces the evidence the scenario needs, preferring native audit logs for questions about who performed an action, such as CloudTrail or the Windows Security log.

Practice question

During a cloud forensics engagement, an investigator must determine which IAM user deleted several EC2 instances in an AWS account last week. Which source provides the most direct evidence?

Want more like this? The CHFI practice test has questions for every domain.

Checklist

0 of 12

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Build one tool matrix and keep refining it. Use rows for platforms and services and columns for task categories: acquisition, memory capture, memory analysis, artifact parsing, timelines, logs and alerts. Put two or three tools in each cell, and leave blanks where no tool applies. This turns a long tool list into a structure you can reason from under exam pressure.

Next, get brief hands-on contact with the free tools: create an image with FTK Imager, open it in Autopsy, run a Volatility plug-in on a sample memory image, and parse an NTUSER.DAT hive with Registry Explorer. Even ten minutes with each makes its purpose memorable.

For cloud, open the AWS and Azure documentation pages for CloudTrail, GuardDuty, Azure Monitor, Microsoft Sentinel and Defender for Cloud and write one sentence on what each records. For databases and email, note which tool reads which log or mailbox format. Revisit the matrix in your last week of study, since this domain is mostly recall.

FAQ

How much of the CHFI exam is Domain 6 Tools/Systems/Programs?

Tools/Systems/Programs is 16% of CHFI v11 under Blueprint v3, about 24 of the 150 questions across two sub-domains.

Do I need to know command syntax for these tools?

Rarely. Questions focus on what each tool does and which platform it supports. Knowing a few common options helps but is not the priority.

Which commercial tools should I know?

EnCase, Magnet AXIOM, X-Ways Forensics and Cellebrite UFED appear widely. Know their general role even if you have only used free tools.

Are the cloud services current product names?

Use current names: Microsoft Sentinel, Microsoft Defender for Cloud and Microsoft Entra ID. Older course materials may still show earlier Azure names.

How many tools does CHFI v11 cover?

EC-Council promotes the course as covering hundreds of tools. The exam samples from them, so focus on categories and the best-known examples.

Is iOS forensics covered even though Domain 5 names only Android?

Yes. This domain explicitly includes iOS, so know at least the main logical and full file system extraction tools for iPhones.

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 6 knowledge

Practise matching tools to tasks and platforms in short timed sets, then fill any gaps in your tool matrix before a mock exam.

Take the CHFI practice test Check your CHFI readiness

Keep going