Course overview
thinQtank® Learning is offering a unique instructor-led training camp that gives students the knowledge and skills needed to run a computer forensic investigation end to end — acquiring and duplicating evidence without altering it, defeating anti-forensics, and analyzing what is left across Windows, Linux, macOS, networks, malware, web attacks, the dark web, cloud services, email, social media, mobile devices and IoT. Students work major forensic investigation scenarios with the standard tools, so the practice is on evidence rather than on slides.
This course also helps students prepare to take the EC-Council CHFI exam (312-49, version 11) — a credential approved by the US Department of Defense under directive 8140 for cyber forensics work roles.
What's included
14 itemsthinQtank® Learning Accelerated Custom Exam Study Guide for the 312-49 exam
Exam delivery in classroom with 98% success
Custom and focused exam preparation software and materials
Course specific thinQtank® Learning publications to promote a fun and exciting learning
Membership to the thinQtank® Learning University Online
WE DO NOT "TEACH THE TEST" - Students will receive valuable examples and discussion
Receive all reading material and study guides when you register
All courses taught by certified instructors
Additional hours of remote lab access
Custom video recordings with even more in-depth learning of course topics
Customized practice exam software
Digital courseware
Retake any or all portions of the course as many times as you like in person or live on-line for 24 months
Six months mentoring access to our engineers after completing the course
What you'll be able to do
14 objectives- Run a forensic investigation process that holds up: scope, authority, documentation and chain of custody
- Understand hard disks, file systems and what actually survives on them
- Acquire and duplicate evidence forensically, without altering the original
- Recognize and defeat anti-forensics techniques — wiping, hiding, timestamps and encryption
- Investigate Windows systems, and the artifacts a Windows machine leaves behind
- Investigate Linux and macOS systems on their own terms rather than by Windows habits
- Perform network forensics: capture, log analysis and reconstructing what crossed the wire
- Analyze malware behavior and its traces on a compromised host
- Investigate web attacks, and the server-side evidence they leave
- Work dark web and cloud forensics, where the evidence is not on a machine you own
- Investigate email and social media, including headers, accounts and attribution
- Perform mobile device forensics across the major platforms
- Perform IoT forensics on embedded and connected devices
- Write findings and present them so they survive scrutiny by a court or a board
The exam
- Exam 312-49 — EC-Council CHFI, version 11
- 150 multiple-choice questions, scenario-based
- Four hours to complete
- PASSING SCORE VARIES BY EXAM FORM, between 60% and 85%. EC-Council sets a cut score per form to keep difficulty consistent, so there is no single published pass mark
- Fifteen modules, from the investigation process through to IoT forensics
- ANSI accredited, and approved by the US Department of Defense under directive 8140 for cyber forensics work roles
- CHFI Voucher — an exam voucher for 312-49 is available through thinQtank for $1,199 USD. Ask when you register and we will add it to your enrollment
Who it's for, and what you need first
Target Audience
- Digital forensic analysts and examiners
- Incident response team members who have to preserve evidence, not just contain a breach
- Security consultants and ethical hackers adding the forensics discipline
- Law enforcement officers and legal staff investigating digital crime
- IT staff responsible for information system security and incident handling
- Service members, veterans and military spouses using AF COOL, Army Credentialing Assistance, MyCAA or VET TEC 2.0
- Anyone in a DoD 8140 cyber forensics work role that requires an approved credential
Prerequisites
- Introductory to intermediate experience in computer forensics
- A working understanding of operating systems, file systems and networking
- Our CEH camp is strongly recommended before this one — EC-Council recommends the same
How it's delivered
Instructor-Led Training
Immersive Live-Online Training
On-Site and Custom Delivery
Training Camp Format
This course is delivered as an instructor-led training camp, with the exam sat in the classroom as part of the camp. Camps are scheduled by cohort, and the balance of lecture and hands-on lab work is set to suit the group and the delivery method. Contact us for the schedule covering your dates.
Dates and locations
26 scheduled| Dates | Location | Status | |
|---|---|---|---|
| Mon Sep 14 – Sep 18, 20265 days · Mon–Fri | Sterling, VA21481 Ridgetop Cir | Guaranteed to run | Request info |
| Mon Sep 28 – Oct 2, 20265 days · Mon–Fri | Atlanta, GA431 Marietta St NW | Guaranteed to run | Request info |
| Mon Oct 19 – Oct 23, 20265 days · Mon–Fri | Burbank, CA3301 N San Fernando Blvd | Guaranteed to run | Request info |
| Mon Nov 16 – Nov 20, 20265 days · Mon–Fri | Sterling, VA21481 Ridgetop Cir | Open | Request info |
| Mon Nov 30 – Dec 4, 20265 days · Mon–Fri | Atlanta, GA431 Marietta St NW | Open | Request info |
| Mon Dec 7 – Dec 11, 20265 days · Mon–Fri | Burbank, CA3301 N San Fernando Blvd | Open | Request info |
| Mon Jan 4 – Jan 8, 20275 days · Mon–Fri | Sterling, VA21481 Ridgetop Cir | Open | Request info |
| Mon Jan 25 – Jan 29, 20275 days · Mon–Fri | Atlanta, GA431 Marietta St NW | Open | Request info |
| Mon Feb 1 – Feb 5, 20275 days · Mon–Fri | Burbank, CA3301 N San Fernando Blvd | Open | Request info |
| Mon Mar 1 – Mar 5, 20275 days · Mon–Fri | Sterling, VA21481 Ridgetop Cir | Open | Request info |
| Mon Mar 15 – Mar 19, 20275 days · Mon–Fri | Atlanta, GA431 Marietta St NW | Open | Request info |
| Mon Mar 29 – Apr 2, 20275 days · Mon–Fri | Burbank, CA3301 N San Fernando Blvd | Open | Request info |
| Mon Apr 26 – Apr 30, 20275 days · Mon–Fri | Sterling, VA21481 Ridgetop Cir | Open | Request info |
| Mon May 10 – May 14, 20275 days · Mon–Fri | Atlanta, GA431 Marietta St NW | Open | Request info |
| Mon May 24 – May 28, 20275 days · Mon–Fri | Burbank, CA3301 N San Fernando Blvd | Open | Request info |
| Mon Jun 21 – Jun 25, 20275 days · Mon–Fri | Sterling, VA21481 Ridgetop Cir | Open | Request info |
| Mon Jul 12 – Jul 16, 20275 days · Mon–Fri | Atlanta, GA431 Marietta St NW | Open | Request info |
| Mon Jul 19 – Jul 23, 20275 days · Mon–Fri | Burbank, CA3301 N San Fernando Blvd | Open | Request info |
| Mon Aug 16 – Aug 20, 20275 days · Mon–Fri | Sterling, VA21481 Ridgetop Cir | Open | Request info |
| Mon Aug 30 – Sep 3, 20275 days · Mon–Fri | Atlanta, GA431 Marietta St NW | Open | Request info |
| Mon Sep 13 – Sep 17, 20275 days · Mon–Fri | Burbank, CA3301 N San Fernando Blvd | Open | Request info |
| Mon Oct 18 – Oct 22, 20275 days · Mon–Fri | Sterling, VA21481 Ridgetop Cir | Open | Request info |
| Mon Oct 25 – Oct 29, 20275 days · Mon–Fri | Atlanta, GA431 Marietta St NW | Open | Request info |
| Mon Nov 15 – Nov 19, 20275 days · Mon–Fri | Burbank, CA3301 N San Fernando Blvd | Open | Request info |
| Mon Dec 6 – Dec 10, 20275 days · Mon–Fri | Sterling, VA21481 Ridgetop Cir | Open | Request info |
| Mon Dec 13 – Dec 17, 20275 days · Mon–Fri | Atlanta, GA431 Marietta St NW | Open | Request info |
Guaranteed to run means the class goes ahead whatever the enrollment.
Prices shown are MSRP. Qualified military personnel funding through Air Force COOL, Army Credentialing Assistance, MyCAA or VET TEC 2.0 pay a flat $1,500 per class, whatever the listed price. Everyone else — call 855-868-4467 about group pricing, discounts and current promotions.