chfi 1
TRANSCRIPT
![Page 1: CHFI 1](https://reader034.vdocuments.site/reader034/viewer/2022052619/5553b710b4c905d4448b4dc5/html5/thumbnails/1.jpg)
Module LXIV - Forensics Investigation Templates
![Page 2: CHFI 1](https://reader034.vdocuments.site/reader034/viewer/2022052619/5553b710b4c905d4448b4dc5/html5/thumbnails/2.jpg)
EC-CouncilCopyright © by EC-Council
All Rights Reserved. Reproduction is Strictly Prohibited
Forensics Investigation Templates
11. CD Investigation Checklist
12. Zip Drive Investigation Checklist
13. Flash Drives Investigation Checklist
14. Tape Investigation Checklist
15. Handheld Device Investigation Checklist
16. Fax Investigation Checklist
17. Hub Investigation Checklist
18. Switch Investigation Checklist
19. Router Investigation Checklist
20. Physical Security Checklist
21. Identity Theft Checklist
1. Case Feedback Form
2. Seizure Record
3. List of Evidences Gathered Form
4. Evidence Preservation Checklist
5. BIOS Configuration
6. System Configuration
7. Application Summary
8. Monitor Investigation Checklist
9. Hard Disk Investigation Checklist
10. Floppy Investigation Checklist
![Page 3: CHFI 1](https://reader034.vdocuments.site/reader034/viewer/2022052619/5553b710b4c905d4448b4dc5/html5/thumbnails/3.jpg)
EC-CouncilCopyright © by EC-Council
All Rights Reserved. Reproduction is Strictly Prohibited
Case Feedback Form
![Page 4: CHFI 1](https://reader034.vdocuments.site/reader034/viewer/2022052619/5553b710b4c905d4448b4dc5/html5/thumbnails/4.jpg)
EC-CouncilCopyright © by EC-Council
All Rights Reserved. Reproduction is Strictly Prohibited
Case Feedback Form (cont’d)
![Page 5: CHFI 1](https://reader034.vdocuments.site/reader034/viewer/2022052619/5553b710b4c905d4448b4dc5/html5/thumbnails/5.jpg)
EC-CouncilCopyright © by EC-Council
All Rights Reserved. Reproduction is Strictly Prohibited
Seizure Record
![Page 6: CHFI 1](https://reader034.vdocuments.site/reader034/viewer/2022052619/5553b710b4c905d4448b4dc5/html5/thumbnails/6.jpg)
EC-CouncilCopyright © by EC-Council
All Rights Reserved. Reproduction is Strictly Prohibited
Seizure Record (cont’d)
![Page 7: CHFI 1](https://reader034.vdocuments.site/reader034/viewer/2022052619/5553b710b4c905d4448b4dc5/html5/thumbnails/7.jpg)
EC-CouncilCopyright © by EC-Council
All Rights Reserved. Reproduction is Strictly Prohibited
List of Evidence Gathered Form
![Page 8: CHFI 1](https://reader034.vdocuments.site/reader034/viewer/2022052619/5553b710b4c905d4448b4dc5/html5/thumbnails/8.jpg)
EC-CouncilCopyright © by EC-Council
All Rights Reserved. Reproduction is Strictly Prohibited
List of Evidences Gathered Form (cont’d)
![Page 9: CHFI 1](https://reader034.vdocuments.site/reader034/viewer/2022052619/5553b710b4c905d4448b4dc5/html5/thumbnails/9.jpg)
EC-CouncilCopyright © by EC-Council
All Rights Reserved. Reproduction is Strictly Prohibited
Evidence Preservation Checklist
1 • Photograph crime scene
2 • Report the crime immediately to immediate authority
3 • Leave the computers and equipment as they are
4 • Don’t shut down or switch on the computers
5 • Switch over to your backup/failover systems
6 • Don’t run any programs
7 • Don’t access files
8 • Establish the chain of custody from the beginning
9 • Preserve physical evidence
![Page 10: CHFI 1](https://reader034.vdocuments.site/reader034/viewer/2022052619/5553b710b4c905d4448b4dc5/html5/thumbnails/10.jpg)
EC-CouncilCopyright © by EC-Council
All Rights Reserved. Reproduction is Strictly Prohibited
BIOS Configuration
![Page 11: CHFI 1](https://reader034.vdocuments.site/reader034/viewer/2022052619/5553b710b4c905d4448b4dc5/html5/thumbnails/11.jpg)
EC-CouncilCopyright © by EC-Council
All Rights Reserved. Reproduction is Strictly Prohibited
BIOS Configuration (cont’d)
![Page 12: CHFI 1](https://reader034.vdocuments.site/reader034/viewer/2022052619/5553b710b4c905d4448b4dc5/html5/thumbnails/12.jpg)
EC-CouncilCopyright © by EC-Council
All Rights Reserved. Reproduction is Strictly Prohibited
System Configuration
![Page 13: CHFI 1](https://reader034.vdocuments.site/reader034/viewer/2022052619/5553b710b4c905d4448b4dc5/html5/thumbnails/13.jpg)
EC-CouncilCopyright © by EC-Council
All Rights Reserved. Reproduction is Strictly Prohibited
System Configuration (cont’d)
![Page 14: CHFI 1](https://reader034.vdocuments.site/reader034/viewer/2022052619/5553b710b4c905d4448b4dc5/html5/thumbnails/14.jpg)
EC-CouncilCopyright © by EC-Council
All Rights Reserved. Reproduction is Strictly Prohibited
System Configuration (cont’d)
![Page 15: CHFI 1](https://reader034.vdocuments.site/reader034/viewer/2022052619/5553b710b4c905d4448b4dc5/html5/thumbnails/15.jpg)
EC-CouncilCopyright © by EC-Council
All Rights Reserved. Reproduction is Strictly Prohibited
Application Summary
![Page 16: CHFI 1](https://reader034.vdocuments.site/reader034/viewer/2022052619/5553b710b4c905d4448b4dc5/html5/thumbnails/16.jpg)
EC-CouncilCopyright © by EC-Council
All Rights Reserved. Reproduction is Strictly Prohibited
Application Summary (cont’d)
![Page 17: CHFI 1](https://reader034.vdocuments.site/reader034/viewer/2022052619/5553b710b4c905d4448b4dc5/html5/thumbnails/17.jpg)
EC-CouncilCopyright © by EC-Council
All Rights Reserved. Reproduction is Strictly Prohibited
Monitor Investigation Checklist
![Page 18: CHFI 1](https://reader034.vdocuments.site/reader034/viewer/2022052619/5553b710b4c905d4448b4dc5/html5/thumbnails/18.jpg)
EC-CouncilCopyright © by EC-Council
All Rights Reserved. Reproduction is Strictly Prohibited
Monitor Investigation Checklist (cont’d)
![Page 19: CHFI 1](https://reader034.vdocuments.site/reader034/viewer/2022052619/5553b710b4c905d4448b4dc5/html5/thumbnails/19.jpg)
EC-CouncilCopyright © by EC-Council
All Rights Reserved. Reproduction is Strictly Prohibited
Hard Disk Investigation Checklist
![Page 20: CHFI 1](https://reader034.vdocuments.site/reader034/viewer/2022052619/5553b710b4c905d4448b4dc5/html5/thumbnails/20.jpg)
EC-CouncilCopyright © by EC-Council
All Rights Reserved. Reproduction is Strictly Prohibited
Hard Disk Investigation Checklist (cont’d)
![Page 21: CHFI 1](https://reader034.vdocuments.site/reader034/viewer/2022052619/5553b710b4c905d4448b4dc5/html5/thumbnails/21.jpg)
EC-CouncilCopyright © by EC-Council
All Rights Reserved. Reproduction is Strictly Prohibited
Hard Disk Investigation Checklist (cont’d)
![Page 22: CHFI 1](https://reader034.vdocuments.site/reader034/viewer/2022052619/5553b710b4c905d4448b4dc5/html5/thumbnails/22.jpg)
EC-CouncilCopyright © by EC-Council
All Rights Reserved. Reproduction is Strictly Prohibited
Floppy Investigation Checklist
![Page 23: CHFI 1](https://reader034.vdocuments.site/reader034/viewer/2022052619/5553b710b4c905d4448b4dc5/html5/thumbnails/23.jpg)
EC-CouncilCopyright © by EC-Council
All Rights Reserved. Reproduction is Strictly Prohibited
Floppy Investigation Checklist (cont’d)
![Page 24: CHFI 1](https://reader034.vdocuments.site/reader034/viewer/2022052619/5553b710b4c905d4448b4dc5/html5/thumbnails/24.jpg)
EC-CouncilCopyright © by EC-Council
All Rights Reserved. Reproduction is Strictly Prohibited
CD Investigation Checklist
![Page 25: CHFI 1](https://reader034.vdocuments.site/reader034/viewer/2022052619/5553b710b4c905d4448b4dc5/html5/thumbnails/25.jpg)
EC-CouncilCopyright © by EC-Council
All Rights Reserved. Reproduction is Strictly Prohibited
CD Investigation Checklist (cont’d)
![Page 26: CHFI 1](https://reader034.vdocuments.site/reader034/viewer/2022052619/5553b710b4c905d4448b4dc5/html5/thumbnails/26.jpg)
EC-CouncilCopyright © by EC-Council
All Rights Reserved. Reproduction is Strictly Prohibited
Zip Drive Investigation Checklist
![Page 27: CHFI 1](https://reader034.vdocuments.site/reader034/viewer/2022052619/5553b710b4c905d4448b4dc5/html5/thumbnails/27.jpg)
EC-CouncilCopyright © by EC-Council
All Rights Reserved. Reproduction is Strictly Prohibited
Zip Drive Investigation Checklist (cont’d)
![Page 28: CHFI 1](https://reader034.vdocuments.site/reader034/viewer/2022052619/5553b710b4c905d4448b4dc5/html5/thumbnails/28.jpg)
EC-CouncilCopyright © by EC-Council
All Rights Reserved. Reproduction is Strictly Prohibited
Flash Drives Investigation Checklist
![Page 29: CHFI 1](https://reader034.vdocuments.site/reader034/viewer/2022052619/5553b710b4c905d4448b4dc5/html5/thumbnails/29.jpg)
EC-CouncilCopyright © by EC-Council
All Rights Reserved. Reproduction is Strictly Prohibited
Flash Drives Investigation Checklist (cont’d)
![Page 30: CHFI 1](https://reader034.vdocuments.site/reader034/viewer/2022052619/5553b710b4c905d4448b4dc5/html5/thumbnails/30.jpg)
EC-CouncilCopyright © by EC-Council
All Rights Reserved. Reproduction is Strictly Prohibited
Tape Investigation Checklist
![Page 31: CHFI 1](https://reader034.vdocuments.site/reader034/viewer/2022052619/5553b710b4c905d4448b4dc5/html5/thumbnails/31.jpg)
EC-CouncilCopyright © by EC-Council
All Rights Reserved. Reproduction is Strictly Prohibited
Tape Investigation Checklist (cont’d)
![Page 32: CHFI 1](https://reader034.vdocuments.site/reader034/viewer/2022052619/5553b710b4c905d4448b4dc5/html5/thumbnails/32.jpg)
EC-CouncilCopyright © by EC-Council
All Rights Reserved. Reproduction is Strictly Prohibited
Handheld Device Investigation Checklist: Blackberry
![Page 33: CHFI 1](https://reader034.vdocuments.site/reader034/viewer/2022052619/5553b710b4c905d4448b4dc5/html5/thumbnails/33.jpg)
EC-CouncilCopyright © by EC-Council
All Rights Reserved. Reproduction is Strictly Prohibited
Handheld Device Investigation Checklist: Blackberry (cont’d)
![Page 34: CHFI 1](https://reader034.vdocuments.site/reader034/viewer/2022052619/5553b710b4c905d4448b4dc5/html5/thumbnails/34.jpg)
EC-CouncilCopyright © by EC-Council
All Rights Reserved. Reproduction is Strictly Prohibited
Handheld Device Investigation Checklist: Blackberry (cont’d)
![Page 35: CHFI 1](https://reader034.vdocuments.site/reader034/viewer/2022052619/5553b710b4c905d4448b4dc5/html5/thumbnails/35.jpg)
EC-CouncilCopyright © by EC-Council
All Rights Reserved. Reproduction is Strictly Prohibited
Handheld Device Investigation Checklist: Blackberry (cont’d)
![Page 36: CHFI 1](https://reader034.vdocuments.site/reader034/viewer/2022052619/5553b710b4c905d4448b4dc5/html5/thumbnails/36.jpg)
EC-CouncilCopyright © by EC-Council
All Rights Reserved. Reproduction is Strictly Prohibited
Handheld Device Investigation Checklist: iPod
![Page 37: CHFI 1](https://reader034.vdocuments.site/reader034/viewer/2022052619/5553b710b4c905d4448b4dc5/html5/thumbnails/37.jpg)
EC-CouncilCopyright © by EC-Council
All Rights Reserved. Reproduction is Strictly Prohibited
Handheld Device Investigation Checklist: iPod (cont’d)
![Page 38: CHFI 1](https://reader034.vdocuments.site/reader034/viewer/2022052619/5553b710b4c905d4448b4dc5/html5/thumbnails/38.jpg)
EC-CouncilCopyright © by EC-Council
All Rights Reserved. Reproduction is Strictly Prohibited
Handheld Device Investigation Checklist: iPod (cont’d)
![Page 39: CHFI 1](https://reader034.vdocuments.site/reader034/viewer/2022052619/5553b710b4c905d4448b4dc5/html5/thumbnails/39.jpg)
EC-CouncilCopyright © by EC-Council
All Rights Reserved. Reproduction is Strictly Prohibited
Handheld Device Investigation Checklist: Mobile Phone
![Page 40: CHFI 1](https://reader034.vdocuments.site/reader034/viewer/2022052619/5553b710b4c905d4448b4dc5/html5/thumbnails/40.jpg)
EC-CouncilCopyright © by EC-Council
All Rights Reserved. Reproduction is Strictly Prohibited
Handheld Device Investigation Checklist: Mobile Phone (cont’d)
![Page 41: CHFI 1](https://reader034.vdocuments.site/reader034/viewer/2022052619/5553b710b4c905d4448b4dc5/html5/thumbnails/41.jpg)
EC-CouncilCopyright © by EC-Council
All Rights Reserved. Reproduction is Strictly Prohibited
Handheld Device Investigation Checklist: Mobile Phone (cont’d)
![Page 42: CHFI 1](https://reader034.vdocuments.site/reader034/viewer/2022052619/5553b710b4c905d4448b4dc5/html5/thumbnails/42.jpg)
EC-CouncilCopyright © by EC-Council
All Rights Reserved. Reproduction is Strictly Prohibited
Handheld Device Investigation Checklist: PDA
![Page 43: CHFI 1](https://reader034.vdocuments.site/reader034/viewer/2022052619/5553b710b4c905d4448b4dc5/html5/thumbnails/43.jpg)
EC-CouncilCopyright © by EC-Council
All Rights Reserved. Reproduction is Strictly Prohibited
Handheld Device Investigation Checklist: PDA (cont’d)
![Page 44: CHFI 1](https://reader034.vdocuments.site/reader034/viewer/2022052619/5553b710b4c905d4448b4dc5/html5/thumbnails/44.jpg)
EC-CouncilCopyright © by EC-Council
All Rights Reserved. Reproduction is Strictly Prohibited
Handheld Device Investigation Checklist: PDA (cont’d)
![Page 45: CHFI 1](https://reader034.vdocuments.site/reader034/viewer/2022052619/5553b710b4c905d4448b4dc5/html5/thumbnails/45.jpg)
EC-CouncilCopyright © by EC-Council
All Rights Reserved. Reproduction is Strictly Prohibited
Fax Investigation Checklist
![Page 46: CHFI 1](https://reader034.vdocuments.site/reader034/viewer/2022052619/5553b710b4c905d4448b4dc5/html5/thumbnails/46.jpg)
EC-CouncilCopyright © by EC-Council
All Rights Reserved. Reproduction is Strictly Prohibited
Fax Investigation Checklist (cont’d)
![Page 47: CHFI 1](https://reader034.vdocuments.site/reader034/viewer/2022052619/5553b710b4c905d4448b4dc5/html5/thumbnails/47.jpg)
EC-CouncilCopyright © by EC-Council
All Rights Reserved. Reproduction is Strictly Prohibited
Fax Investigation Checklist (cont’d)
![Page 48: CHFI 1](https://reader034.vdocuments.site/reader034/viewer/2022052619/5553b710b4c905d4448b4dc5/html5/thumbnails/48.jpg)
EC-CouncilCopyright © by EC-Council
All Rights Reserved. Reproduction is Strictly Prohibited
Hub Investigation Checklist
![Page 49: CHFI 1](https://reader034.vdocuments.site/reader034/viewer/2022052619/5553b710b4c905d4448b4dc5/html5/thumbnails/49.jpg)
EC-CouncilCopyright © by EC-Council
All Rights Reserved. Reproduction is Strictly Prohibited
Hub Investigation Checklist (cont’d)
![Page 50: CHFI 1](https://reader034.vdocuments.site/reader034/viewer/2022052619/5553b710b4c905d4448b4dc5/html5/thumbnails/50.jpg)
EC-CouncilCopyright © by EC-Council
All Rights Reserved. Reproduction is Strictly Prohibited
Hub Investigation Checklist (cont’d)
![Page 51: CHFI 1](https://reader034.vdocuments.site/reader034/viewer/2022052619/5553b710b4c905d4448b4dc5/html5/thumbnails/51.jpg)
EC-CouncilCopyright © by EC-Council
All Rights Reserved. Reproduction is Strictly Prohibited
Switch Investigation Checklist
![Page 52: CHFI 1](https://reader034.vdocuments.site/reader034/viewer/2022052619/5553b710b4c905d4448b4dc5/html5/thumbnails/52.jpg)
EC-CouncilCopyright © by EC-Council
All Rights Reserved. Reproduction is Strictly Prohibited
Switch Investigation Checklist (cont’d)
![Page 53: CHFI 1](https://reader034.vdocuments.site/reader034/viewer/2022052619/5553b710b4c905d4448b4dc5/html5/thumbnails/53.jpg)
EC-CouncilCopyright © by EC-Council
All Rights Reserved. Reproduction is Strictly Prohibited
Switch Investigation Checklist (cont’d)
![Page 54: CHFI 1](https://reader034.vdocuments.site/reader034/viewer/2022052619/5553b710b4c905d4448b4dc5/html5/thumbnails/54.jpg)
EC-CouncilCopyright © by EC-Council
All Rights Reserved. Reproduction is Strictly Prohibited
Router Investigation Checklist
![Page 55: CHFI 1](https://reader034.vdocuments.site/reader034/viewer/2022052619/5553b710b4c905d4448b4dc5/html5/thumbnails/55.jpg)
EC-CouncilCopyright © by EC-Council
All Rights Reserved. Reproduction is Strictly Prohibited
Router Investigation Checklist (cont’d)
![Page 56: CHFI 1](https://reader034.vdocuments.site/reader034/viewer/2022052619/5553b710b4c905d4448b4dc5/html5/thumbnails/56.jpg)
EC-CouncilCopyright © by EC-Council
All Rights Reserved. Reproduction is Strictly Prohibited
Router Investigation Checklist (cont’d)
![Page 57: CHFI 1](https://reader034.vdocuments.site/reader034/viewer/2022052619/5553b710b4c905d4448b4dc5/html5/thumbnails/57.jpg)
EC-CouncilCopyright © by EC-Council
All Rights Reserved. Reproduction is Strictly Prohibited
Physical Security Checklist
![Page 58: CHFI 1](https://reader034.vdocuments.site/reader034/viewer/2022052619/5553b710b4c905d4448b4dc5/html5/thumbnails/58.jpg)
EC-CouncilCopyright © by EC-Council
All Rights Reserved. Reproduction is Strictly Prohibited
Physical Security Checklist (cont’d)
![Page 59: CHFI 1](https://reader034.vdocuments.site/reader034/viewer/2022052619/5553b710b4c905d4448b4dc5/html5/thumbnails/59.jpg)
EC-CouncilCopyright © by EC-Council
All Rights Reserved. Reproduction is Strictly Prohibited
Identity Theft Checklist
1. Report the crime to the police:1. Provide copies of evidence
2. Obtain copy of the Police Report
2. Request information on fraudulent accounts
3. In the case of lost credit cards:1. Call the bank and close your account
2. Follow up and trace your cards
4. In case your mail is stolen and your address is changed:1. Notify the postal inspector
5. If someone has stolen your Social Security number:1. Call the Employment Department
6. Contact FTC (Federal Trade Commission)
7. Other:1. Use secure mailboxes to send and receive mail
2. Shred confidential documents
3. Review credit reports annually
4. Report lost or stolen checks immediately
5. Do not ignore bills that include suspicious charges