Valid EC-COUNCIL 312-49 Study Guide, New 312-49 Cram Materials

• Anti-Forensics Technique: Data/File Deletion
• What Happens When a File is Deleted in Windows?
• Recycle Bin in Windows
• File Carving
• Anti-Forensics Techniques: Password Protection
• Bypassing Passwords on Powered-off Computer
• Anti-Forensics Technique: Steganography
• Anti-Forensics Technique: Alternate Data Streams
• Anti-Forensics Techniques: Trail Obfuscation
• Anti-Forensics Technique: Artifact Wiping
• Anti-Forensics Technique: Overwriting Data/Metadata
• Anti-Forensics Technique: Encryption
• Anti-Forensics Technique: Program Packers
• Anti-Forensics Techniques that Minimize Footprint
• Anti-Forensics Technique: Exploiting Forensics Tools Bugs
• Anti-Forensics Technique: Detecting Forensic Tool Activities
• Anti-Forensics Countermeasures
• Anti-Forensics Tools

- Analyze Various Files Associated with Windows and Linux and Android Devices

• Windows File Analysis
• Metadata Investigation
• Windows ShellBags
• Analyze LNK Files
• Analyze Jump Lists
• Event logs
• File System Analysis using The Sleuth Kit (TSK)
• Linux Memory Forensics
• APFS File System Analysis: Biskus APFS Capture
• Parsing metadata on Spotlight
• Logical Acquisition of Android Devices
• Physical Acquisition of Android Devices
• SQLite Database Extraction
• Challenges in Mobile Forensics

- Analyze various logs and perform network forensics to investigate network attacks

• Analyzing Firewall Logs
• Analyzing IDS Logs
• Analyzing Honeypot Logs
• Analyzing Router Logs
• Analyzing DHCP Logs
• Why investigate Network Traffic?
• Gathering evidence via Sniffers
• Sniffing Tool: Tcpdump
• Sniffing Tool: Wireshark
• Analyze Traffic for TCP SYN flood DOS attack
• Analyze Traffic for SYN-FIN flood DOS attack
• Analyze traffic for FTP password cracking attempts
• Analyze traffic for SMB password cracking attempts
• Analyze traffic for sniffing attempts
• Analyze traffic to detect malware activity
• Centralized Logging Using SIEM Solutions
• SIEM Solutions: Splunk Enterprise Security (ES)
• SIEM Solutions: IBM Security QRadar
• Examine Brute-Force Attacks
• Examine DoS Attack
• Examine Malware Activity
• Examine data exfiltration attempts made through FTP
• Examine network scanning attempts
• Examine ransomware attack
• Detect rogue DNS server (DNS hijacking/DNS spoofing)
• Wireless network security vulnerabilities
• Performing attack and vulnerability monitoring
• Detect a rogue access point
• Detect access point MAC spoofing attempts
• Detect misconfigured access point
• Detect honeypot access points
• Detect signal jamming attack

- Analyze Various Logs and Perform Web Application Forensics to Examine Various Web Based Attacks

• Investigating Cross-Site Scripting Attack
• Investigating SQL Injection Attack
• Investigating Directory Traversal Attack
• Investigating Command Injection Attack
• Investigating Parameter Tampering Attack
• Investigating XML External Entity Attack
• Investigating Brute Force Attack
• Investigating Cookie Poisoning Attack

- Perform Forensics on Databases, Dark Web, Emails, Cloud and IoT devices

• Database Forensics Using SQL Server Management Studio
• Database Forensics Using ApexSQL DBA
• Common Scenario for Reference
• MySQL Forensics for WordPress Website Database: Scenario 1
• MySQL Forensics for WordPress Website Database: Scenario 2
• Tor Browser Forensics: Memory Acquisition
• Collecting Memory Dumps
• Memory Dump Analysis: Bulk Extractor
• Forensic Analysis of Memory Dumps to Examine Email Artifacts (Tor Browser Open)
• Forensic Analysis of Storage to Acquire the Email Attachments (Tor Browser Open)
• Forensic Analysis of Memory Dumps to Examine Email Artifacts (Tor Browser Closed)
• Forensic Analysis of Storage to Acquire the Email Attachments (Tor Browser Closed)
• Forensic Analysis: Tor Browser Uninstalled
• Dark Web Forensics Challenges
• Introduction to email crime investigation
• Steps to investigate email crimes
• Division of Responsibilities
• Where Is the Data Stored in Azure?
• Logs in Azure
• Acquiring A VM in Microsoft Azure
• Acquiring A VM Snapshot Using Azure Portal
• Acquiring A VM Snapshot Using PowerShell
• AWS Forensics
• Wearable IoT Device: Smartwatch
• IoT Device Forensics: Smart Speaker-Amazon Echo

- Perform Static and Dynamic Malware Analysis in a Sandboxed Environment

• Malware Analysis: Static
• Analyzing Suspicious MS Office Document
• Analyzing Suspicious PDF Document
• Malware Analysis: Dynamic

- Analyze Malware Behavior on System and Network Level, and Analyze Fileless Malware

• System Behavior Analysis: Monitoring Registry Artifacts
• System Behavior Analysis: Monitoring Processes
• System Behavior Analysis: Monitoring Windows Services
• System Behavior Analysis: Monitoring Startup Programs
• System Behavior Analysis: Monitoring Windows Event Logs
• System Behavior Analysis: Monitoring API Calls
• System Behavior Analysis: Monitoring Device Drivers
• System Behavior Analysis: Monitoring Files and Folders
• Network Behavior Analysis: Monitoring Network Activities
• Network Behavior Analysis: Monitoring Port
• Network Behavior Analysis: Monitoring DNS
• Fileless Malware Analysis: Emotet
• Emotet Malware Analysis
• Emotet Malware Analysis: Timeline of the Infection Chain

• Introduction to Digital Evidence
• Types of Digital Evidence
• Characteristics of Digital Evidence
• Role of Digital Evidence
• Sources of Potential Evidence
• Understanding Hard Disk
• Understanding Solid State Drive (SSD)
• RAID Storage System
• NAS/SAN Storage
• Disk Interfaces
• Logical Structure of Disks

- Understand the fundamental concepts and working of desktop and mobile Operating Systems

• What is the Booting Process?
• Essential Windows System Files
• Windows Boot Process: BIOS-MBR Method
• Windows Boot Process: UEFI-GPT
• Macintosh Boot Process
• Linux Boot Process
• Windows File Systems
• Linux File Systems
• Mac OS X File Systems
• MAC Forensics Data
• MAC Log Files
• MAC Directories
• CD-ROM / DVD File System
• Virtual File System (VFS) and Universal Disk Format File System (UDF)
• Architectural Layers of Mobile Device Environment
• Android Architecture Stack
• Android Boot Process
• iOS Architecture
• iOS Boot Process
• Mobile Storage and Evidence Locations
• Mobile Phone Evidence Analysis
• Data Acquisition Methods
• Components of Cellular Network
• Different Cellular Networks
• Cell Site Analysis: Analyzing Service Provider Data
• CDR Contents
• Subscriber Identity Module (SIM)
• Different types of network-based evidence

- Understand different types of logs and their importance in forensic investigations

• Understanding Events
• Types of Logon Events
• Event Log File Format
• Organization of Event Records
• ELF_LOGFILE_HEADER structure
• EventLogRecord Structure
• Windows 10 Event Logs
• Other Audit Events
• Evaluating Account Management Events
• Log files as evidence
• Legal criteria for admissibility of logs as evidence
• Guidelines to ensure log file credibility and usability
• Ensure log file authenticity
• Maintain log file integrity
• Implement centralized log management
• IIS Web Server Architecture
• IIS Logs
• Analyzing IIS Logs
• Apache Web Server Architecture
• Apache Web Server Logs
• Apache Access Logs
• Apache Error Logs

- Understand various encoding standards and analyze various file types

• Character Encoding Standard: ASCII
• Character Encoding Standard: UNICODE
• OFFSET
• Understanding Hex Editors
• Understanding Hexadecimal Notation
• Image File Analysis: JPEG
• Image File Analysis: BMP
• Understanding EXIF data
• Hex View of Popular Image File Formats
• PDF File Analysis
• Word File Analysis
• PowerPoint File Analysis
• Excel File Analysis
• Hex View of Other Popular File Formats

- Understand the fundamental working of WAF and MySQL Database

• Web Application Firewall (WAF)
• Benefits of WAF
• Limitations of WAF
• Data Storage in SQL Server
• Database Evidence Repositories
• MySQL Forensics
• Viewing the Information Schema
• MySQL Utility Programs for Forensic Analysis

• Rules of Evidence
• Best Evidence Rule
• Federal Rules of Evidence
• Scientific Working Group on Digital Evidence (SWGDE)
• ACPO Principles of Digital Evidence
• Seeking Consent
• Obtaining Witness Signatures
• Obtaining Warrant for Search and Seizure
• Searches Without a Warrant
• Initial Search of the Scene
• Preserving Evidence
• Chain of Custody
• Sanitize the Target Media
• Records of Regularly Conducted Activity as Evidence
• Division of Responsibilities

- Understand different laws and legal issues that impact forensic investigations

• Computer Forensics: Legal Issues
• Computer Forensics: Privacy Issues
• Computer Forensics and Legal Compliance
• Other Laws that May Influence Computer Forensics
• U.S. Laws Against Email Crime: CAN-SPAM Act