EC-COUNCIL 312-49 考試概覽:

認證廠商:	EC-Council
考試名稱:	電腦駭客鑑識調查師 (CHFI)
考試代碼:	312-49
及格分數:	60%–85% (依試卷版本而定)
考試費用:	650 美元 (官方建議參考價)
證照有效期限:	3 年 (需完成重新認證)
考試時間:	240 分鐘
相關認證:	EC-Council 認證事件處理師 (ECIH) EC-Council 認證鑑識分析師
支援語言:	English
考試形式:	單選題, 複選題
實際考試題數:	150
範例考題:	EC-COUNCIL 312-49 範例考題
考試方式:	可透過 EC-Council 考試平台或授權考試中心應考（提供線上監考或現場應考模式）。
必備條件:	無強制先修條件；若未參加官方培訓，建議具備 2 年以上資訊安全或數位鑑識領域工作經驗。
官方大綱網址:	https://www.eccouncil.org/train-certify/computer-hacking-forensic-investigator-chfi/

EC-COUNCIL 312-49 考試大綱：

主題	簡介
主題 1	Email and Social Media Forensics: Examines email protocols, header analysis, social media data investigation, artifacts from messaging platforms, and legal aspects of digital correspondence.
主題 2	Windows Forensics: This domain includes collecting and analyzing volatile and non-volatile data, registry analysis, event logs, user artifacts (LNK, jump lists), memory forensics, and Windows application artifacts.
主題 3	IoT Forensics: Studies forensic investigation of Internet of Things devices, embedded systems, networked sensors, smart home devices, and artifacts from IoT ecosystems.
主題 4	Computer Forensics in Today : Covers fundamentals of digital forensics, importance of forensics in incident response, cybercrimes & investigations, forensic readiness, roles of forensic investigators, and standards & best practices.
主題 5	Defeating Anti-Forensics Techniques: Covers anti-forensic methods such as data hiding, steganography, file wiping, encryption, metadata tampering, trail obfuscation, and countermeasures.
主題 6	Malware Forensics: Covers static & dynamic malware analysis, behavior and network behavior analysis, ransomware, code analysis, and linking malware to forensic evidence.
主題 7	Computer Forensic Investigation Process: Contains the phases of a forensic investigation: first response, investigation planning, evidence collection, analysis, reporting, and post-investigation actions.
主題 8	Linux and Mac Forensics: This domain examines forensic investigation in Unix Linux and macOS systems, volatile memory capture, file systems (e.g., ext, APFS), logs, and operating system-specific artifacts.
主題 9	Understanding Hard Disks and File Systems: Deals with disk structure, partitioning, file systems (NTFS, FAT, ext, HFS), boot process of different OS (Windows, Linux, macOS), and low-level file system behaviors.
主題 10	Data Acquisition and Duplication: This domain focuses on techniques for acquiring forensic images, live vs dead acquisition, order of volatility, forensic duplication, and ensuring the integrity of data.
主題 11	Network Forensics: Covers capturing and analyzing network traffic, event correlation, investigating intrusions, identifying indicators of compromise (IoCs), and wireless forensics.
主題 12	Mobile Forensics: Includes forensic acquisition and analysis of mobile devices (Android, iOS), file systems, app data, call logs, SMS, rooting jailbreaking, and mobile OS artifacts.
主題 13	Dark Web Forensics: Focuses on forensic strategies for the dark web: understanding Tor networks, analyzing dark web artifacts, tracing hidden transactions, and dark web investigation best practices.