CHFI (Computer Hacking Forensic Investigator)
CHFI is EC-Council's digital forensics exam. It covers evidence handling and chain of custody, investigation procedures, anti-forensics, and analysis of operating systems, networks, cloud, mobile and IoT devices. EC-Council lists law enforcement, defense and military personnel, legal professionals, systems administrators, IT managers and government agencies among its target audience.
Exam Details
Multiple-choice exam (EC0 312-49) delivered through ECC exam centers, with several exam forms drawn from different question banks.
EC-Council lists the CHFI exam voucher at $650. Candidates who qualify through experience instead of official training also pay a $100 non-refundable eligibility application fee.
Requirements and Renewal
Prerequisites
Official EC-Council training or at least two years of information security work experience with an approved eligibility application. EC-Council expects candidates in its training program to have basic knowledge of IT and cybersecurity, computer forensics and incident response.
Renewal
EC-Council Continuing Education (ECE): 120 credits per certification within each three-year cycle and an annual ECE fee of $80. Members who miss the requirements are suspended and have 12 months to comply before revocation.
Current Version
312-49, exam blueprint v4.
Exam Domains
6 domains| Domain | Weight |
|---|---|
| Forensic Science | 15% |
| Regulations, Policies and Ethics | 10% |
| Digital Evidence | 18% |
| Procedures and Methodology | 17% |
| Digital Forensics | 29% |
| Tools/Systems/Programs | 11% |
DoD 8140 Work Roles
3 work rolesThe DoD 8140 Qualification Matrix V2.1 lists CHFI as a foundational qualification option for these DoD Cyber Workforce Framework work roles, up to the proficiency level shown. Lower levels of the same work role are also covered.
Certification Lists
Related Tool Categories
Frequently Asked Questions
What does CHFI stand for?→
CHFI stands for Computer Hacking Forensic Investigator.
How many questions are on the CHFI exam?→
The 312-49 exam has 150 questions with a 4-hour limit. The cut score is between 60% and 85% depending on the exam form.
Who is eligible for CHFI?→
Candidates either complete official EC-Council training or document at least two years of information security experience in an eligibility application.
Does CHFI expire?→
CHFI falls under the ECE policy. Holders need 120 credits every three years and pay an $80 annual fee to stay certified.
Sources
Exam details are checked against official EC-Council pages. Fees, exam versions, and renewal rules change; confirm with EC-Council before registering. CHFI is a trademark of its owner. This site is not affiliated with or endorsed by EC-Council.