CHFI is a digital forensics course that teaches the defensive workflow that runs after a security incident: how to identify, acquire, preserve, analyse, and report on digital evidence in a way that holds up in court. It assumes CEH-level knowledge is going in, since you're investigating the kinds of attacks CEH teaches.

What will you learn:

1. Run a full forensic investigation end to end — first response, evidence collection, analysis, and reporting.
2. Establish and maintain chain of custody and handle evidence so it stays legally admissible.
3. Read storage media and file systems (FAT, NTFS, ext, HFS+, APFS), understand disk structures and the boot process, and know where evidence hides.
4. Acquire and duplicate data using live vs. dead acquisition and write blockers, and verify integrity with MD5/SHA hashing (FTK Imager).
5. Detect and defeat anti-forensics — data hiding, wiping, trail obfuscation, steganography, and encryption — and recover deleted data.
6. Perform Windows forensics — registry, event logs, prefetch/jump lists, browser and file artifacts, and memory analysis (Autopsy, Volatility).
7. Investigate Linux and Mac systems through their artifacts and logs.
8. Do network forensics — capture and analyse traffic, correlate logs, and reconstruct events from PCAPs (Wireshark).
9. Analyse malware with static and dynamic techniques and identify indicators of compromise (IOCs).
10. Investigate web attacks by tracing SQL injection, XSS, and web-shell activity through server and application logs.
11. Handle dark web and cloud forensics, including Tor basics and evidence acquisition across AWS, Azure, and GCP.
12. Examine email, social media, mobile, and IoT evidence, including email-header and phishing analysis.
13. Write forensic reports and understand expert-witness testimony.