After this course you can run a digital investigation in an orderly way: secure evidence, analyse disks and memory, bring together traces from networks, cloud and mobile devices, and report results that others can follow. You will also recognise when someone has tried to cover their tracks. The course suits you if you work in security, incident response or an internal investigation role. Bring IT security basics so you can concentrate on the forensic work itself.
What you’ll take away.
- Plan and document a forensic investigation phase by phase
- Acquire data from disks and analyse file systems
- Examine Windows, Linux and macOS, including memory and the registry
- Bring together traces from networks, cloud, email and mobile devices
- Recognise anti-forensics techniques
Your training in detail
- Who is it for?
- Security and forensics professionals, incident responders and IT staff who need to investigate digital evidence properly.
- Prerequisites
- Basic knowledge of IT security, operating systems and incident response. EC-Council lists no formal prerequisites.
- Format & planning
- Standard length: 5 training days. A different length can be arranged for companies.
Agenda: from understanding to application
Our independently developed agenda proposal. Focus areas, lab environment and scope are agreed before booking.
Fundamentals, investigation phases and evidence handling
Disks, file systems and data acquisition
Anti-forensics and countermeasures
Windows, Linux and macOS forensics
Network, wireless and cloud forensics
Investigating malware and web application attacks
Dark web, mobile, IoT, email and social media
You analyse a test image of a compromised system, reconstruct the timeline and record your conclusions in a report.
Exams, licences & credentials
This course prepares you for the EC-Council 312-49 exam. The exam and its fees are included only if your offer confirms them. The certificate is issued by EC-Council, not NextNowa. This is not an official EC-Council course. EC-Council names completing EC-Council training and passing the exam as the route to the certificate. Check with EC-Council before you book which eligibility route applies to you.
Vendor references & review date
Sources checked on 2026-11-04. These sources describe the technology or external exam requirements. They do not imply a partnership with NextNowa.
Your learning content
These objectives describe the training topic. The specific syllabus, dates and trainer are agreed before booking; the written offer is binding.
Frequently asked questions
What is the 312-49 exam like?
EC-Council lists 150 multiple-choice questions in four hours, taken through its own exam portal.
Does this course make me a court-appointed expert?
No. You learn digital forensics methods. This does not replace an appointment as an expert witness or legal advice.
Does Computer Hacking Forensic Investigator (CHFI): digital forensics include a certificate?
This course prepares you for the EC-Council 312-49 exam. The exam and its fees are included only if your offer confirms them. The certificate is issued by EC-Council, not NextNowa. This is not an official EC-Council course. EC-Council names completing EC-Council training and passing the exam as the route to the certificate. Check with EC-Council before you book which eligibility route applies to you.