Computer Hacking Forensic Investigator

This is a 5 day, instructor-led course.

The CHFI Program certifies individuals in the specific security discipline of computer forensics from a vendor-neutral perspective. The CHFI certification will fortify the application knowledge of law enforcement personnel, system administrators, security officers, defense and military personnel, legal professionals, bankers, security professionals, and anyone who is concerned about the integrity of the network infrastructure.
 
Computer forensics is the application of computer investigation and analysis techniques in the interests of determining potential legal evidence. Evidence might be sought in a wide range of computer crimes or misuse, including but not limited to; theft of trade secrets, theft of or destruction of intellectual property, and fraud. Computer forensic investigators can draw from an array of methods for discovering data that resides in a computer system, or recovering deleted, encrypted, or damaged file information.
 
The CHFI course will give participants the necessary skills to identify an intruder’s footprints and to properly gather the necessary evidence to prosecute. Many of today’s top tools of the forensic trade will be taught during this course, including software, hardware and specialized techniques. It is no longer a matter of “will your organization be comprised (hacked)?” but, rather, “when?” Today’s battle between corporations, governments, and countries are no longer fought only in the typical arenas of boardrooms or battlefields using physical force. Now, the battlefield starts in the technical realm, which ties into most every facet of modern day life. If you or your organization requires the knowledge or skills to identify, track, and prosecute the cybercriminal, then this is the course for you.

The CHFI program is designed for all IT professionals involved with information system security, computer forensics, and incident response:
•   Police and other law enforcement personnel
•   Defense and Military personnel
•   e-Business Security professionals
•   Systems administrators
•   Legal professionals
•   Banking, Insurance and other professionals
•   Government agencies
•   IT managers

Upon successful completion of this course, students will have learned:
•   The computer forensic investigation process and the various legal issues involved 
•   Evidence searching, seizing and acquisition methodologies in a legal and forensically sound manner 
•   Different types of digital evidence, rules of evidence, digital evidence examination process, and electronic crime and digital evidence consideration by crime category 
•   Roles of first responder, first responder toolkit, securing and evaluating electronic crime scene, conducting preliminary interviews, documenting electronic crime scene, collecting and preserving electronic evidence, packaging and transporting electronic evidence, and reporting the crime scene 
•   How to set up a computer forensics lab and the tools involved in it 
•   Various file systems and how to boot a disk 
•   Gathering volatile and non-volatile information from Windows 
•   Data acquisition and duplication rules, validation methods and tools required 
•   How to recover deleted files and deleted partitions in Windows, Mac OS X, and Linux 
•   The process involved in forensic investigation using AccessData FTK and EnCase 
•   Steganography and its techniques, Steganalysis, and image file forensics 
•   Password Cracking Concepts, tools, types of password attacks and how to investigate password protected files 
•   Different types of log capturing, log management, time synchronization, and log capturing tools 
•   How to investigate logs, network traffic, wireless attacks, and web attacks 
•   How to track e-mails and investigate e-mail crimes
•   Mobile forensics and mobile forensics software and hardware tools 
•   How to write investigative reports