The 312-49 test measures an individual’s ability to identify an intruder’s footprints and to properly gather the necessary evidence to prosecute. Before taking the 312-49 test, you should practice the following:

  1. Understand Internet laws of different countries.
  2. Review first responder procedure and CSIRT.
  3. Know the functions of file system, hard disk, and digital media devices.
  4. Understand Windows, Linux and Macintosh boot process.
  5. Practice Windows forensic tools.
  6. Identify commands and different kits of Linux forensics.
  7. Identify software and hardware tools for data acquisition and duplication.
  8. Identify partition recovery tools and methods.
  9. Understand different attacks and tools of steganography.
  10. Know about the password cracking tools and attacks.
  11. Understand wireless and Web attacks.

  12. Use different types of DoS attacks.
  13. Recognize email sending-receiving System.
  14. Identify corporate espionage.
  15. Understand laws of Copyright and Trademark.
  16. Understand laws on sexual harassment.
  17. Understand laws of child pornography.
  18. Study features and tools for PDA forensics.
  19. Study features and tools for ipod forensics.
  20. Study working and functions of Blackberry.
  21. Create investigative and evidence reports.
  22. Recognize privacy issue involved in investigations.
  23. Understand forensic process and collecting evidences.