Dark Web Forensics for Ethical Hackers Training (EC-Council)
Dark Web Forensics for Ethical Hackers is an EC-Council iClass course focused on dark web investigations. It explains how Tor works under the hood, maps out the main kinds of hidden marketplaces and teaches an investigation approach that keeps the investigator's identity safe. It is not a certification track but a specialist workshop that pairs well with CHFI or C|TIA. We deliver it live online, in person in Casablanca or on-site at your organization, in French or English.
The essentials
Publisher : EC-Council
Duration : Duration on request
Level : Intermediate
Formats : Live virtual class · In-person in Casablanca · On-site (intra-company)
Languages : French or English
Exam facts : EC-Council iClass course with no dedicated certification exam
Exam voucher: included or optional depending on the package — contact us.
Understand Tor's architecture: circuits, relays, exit nodes and hidden services
Explain how cryptocurrency tumblers are used to launder funds
Recognise the main families of illicit marketplaces and how they operate
Run a step-by-step investigation without exposing your identity or infrastructure
Work with onion crawlers and an amnesic system such as TAILS
Document findings so they can feed legal or intelligence work
Program
Technical background of the dark web
The Tor network, relays and exit nodes
.onion services
Tumblers and cryptocurrency traceability
Hidden marketplaces landscape
Drugs and financial crime
Illegal content and extremist propaganda
How markets run, build reputation and disappear
Investigation methodology
Step-by-step investigation process
Protecting the investigator's identity
Automated collection with Tor crawlers
Tools and hands-on labs
Setting up TAILS and Onion Crawler
Lab-based vulnerability assessment of hidden services
Using results and writing them up
Prerequisites
Solid networking and operating system fundamentals
Prior experience in digital forensics or threat intelligence recommended
Participants must be at least 18 years old
Target audience
Forensic investigators handling data leaks or financial fraud
Cyber threat intelligence (CTI) analysts
Law enforcement and cybercrime units
Bank compliance and anti-money-laundering teams
The exam
Dark Web Forensics is not tied to any EC-Council certification exam with its own code. If you want a recognised digital forensics credential, we suggest pairing it with CHFI v11 (exam 312-49), which has a full module on dark web forensics. EC-Council keeps an unredacted version of the material for law enforcement agencies only.
Preparation tips
Brush up on TCP/IP, DNS and encryption basics before the session
Prepare a dedicated machine or an isolated VM for the exercises
Check the legal framework for online investigations in your country
Frequently asked questions (FAQ)
Does this course lead to a certification?
No. It is a specialist EC-Council iClass course without a dedicated certification exam. If you need a recognised credential, pair it with CHFI v11, which covers dark web forensics as one of its fifteen modules.
How long is the course?
EC-Council does not publish an official duration for this course. We tailor the format and depth to your team's needs, so contact us for a detailed schedule and quote.
Is it legal to investigate the dark web?
Using Tor is legal in most countries, but some actions taken on hidden services are not. The course stresses staying within the law, working under a clear mandate and getting prior authorisation from your organisation.
How is it different from the CHFI dark web module?
CHFI mostly covers the traces left on a user's machine. This course goes further into marketplaces, online investigation methods and collection tools.
Do I need to be in law enforcement?
No. The standard version is open to adult security professionals; only the unredacted edition is restricted to law enforcement.