01Authority, case scope and forensic readiness
Establish who authorized the work, which systems and data are in scope, what legal or policy restrictions apply and which staff own the case. Design a collection plan before touching a source.
Practice exerciseFor a fictional employee-device incident, draft an authorization checklist and a stop condition for data outside the approved scope.
Learning outcomeIdentify what an investigator must clarify before acquisition and why a technically accessible file may still be out of scope.
02Evidence preservation and chain of custody
Record source identity, collector, timestamps, handling, storage and every transfer. Use hashes to detect changes while recognizing that a matching hash does not prove the source was collected lawfully or completely.
Practice exerciseComplete a synthetic custody ledger for a disk image changing hands twice; flag a missing seal or timestamp and describe how to resolve the gap.
Learning outcomeExplain both integrity evidence and the limits of an incomplete custody record.
03Acquisition strategy and validation
Choose between live and powered-down collection based on volatility, encryption, downtime and evidence risk. Preserve originals, document tool settings and compare acquisition results with source expectations.
Practice exercisePlan two authorized acquisitions: a running encrypted laptop and a detached storage device. List data that may be lost by the wrong order of operations.
Learning outcomeDefend a collection sequence and state its tradeoffs without assuming every case has one universal method.
04Operating-system and file artifacts
Interpret file-system metadata, user activity and timestamps in context. Account for time zones, clock drift, copying and normal system behavior before asserting intent from an artifact.
Practice exerciseBuild a timeline from fabricated file, login and application records. Mark each event as observed, inferred or unresolved.
Learning outcomeExplain how artifact provenance and clock quality affect the confidence of a timeline.
05Network, email and application evidence
Correlate message headers, web logs, authentication events and network flows with endpoint observations. Keep raw records distinct from an analyst's derived timeline and avoid exposing unrelated personal content.
Practice exerciseGiven sanitized mailbox and proxy records, test whether a suspicious attachment was opened, merely delivered or blocked. State the missing evidence.
Learning outcomeConstruct a defensible cross-source narrative without turning correlation into unsupported causation.
06Cloud, mobile and volatile evidence
Assess custody and retention in provider-controlled systems, mobile devices and memory captures. Capture relevant audit context quickly but respect platform permissions and preservation requests.
Practice exercisePrepare a fictional cloud-account preservation request listing event sources, retention deadlines, owners and a least-privilege export path.
Learning outcomeRecognize which evidence disappears first and when provider or legal coordination is needed.
07Anti-forensics and alternative explanations
Treat missing logs, changed metadata and encrypted content as investigative questions, not automatic proof of concealment. Check tool error, normal rotation and administrative maintenance as alternative causes.
Practice exerciseReview a synthetic case with a gap in logs and a changed file timestamp. Write three hypotheses and one non-destructive validation step for each.
Learning outcomeReport uncertainty explicitly and avoid overstating what an artifact establishes.
08Reporting, peer review and exam readiness
Separate methods, observations, interpretations, limitations and conclusions. Make the report reproducible for a qualified reviewer while protecting confidential data, then map weak knowledge areas to the official CHFI blueprint.
Practice exerciseWrite a one-page forensic summary with evidence references, custody caveats and a clearly labeled alternative explanation; have a peer challenge it.
Learning outcomeDeliver a concise, reviewable finding and a blueprint-led study plan instead of relying on copied exam dumps.