CHFI 3: Operating Systems Forensics

Catalog description

Third volume in a four-course series preparing students for the EC-Council Computer Hacking Forensic Investigator (CHFI) certification. Builds on foundational forensic knowledge by introducing advanced investigative techniques for extracting, interpreting, and documenting evidence from Microsoft Windows, Apple macOS, and Linux environments. Examines file systems, memory, logs, and system artifacts using both commercial and open-source tools. Covers file recovery, timeline analysis, malware trace discovery, and live response procedures. Culminates in the development of a comprehensive forensic examination report based on simulated case data.