CHFI is the Computer Hacking Forensic Investigator certification from EC-Council. It’s aimed at the investigation side of security rather than the attack or defence sides. Where CEH asks how an intrusion happens, CHFI asks how you prove what happened afterwards.
What Is CHFI?
CHFI covers the digital forensics process end to end: acquiring evidence without altering it, analysing disks and memory, following an intrusion across a network, and producing findings that survive scrutiny.
The emphasis on evidence handling is what separates forensics from incident response. GCIH is about containing and recovering from an incident quickly. CHFI assumes someone may eventually have to defend the findings, so the process and the chain of custody matter as much as the technical result.
What Does the Exam Cover?
The exam spans fifteen modules, which fall into three groups.
Foundations covers the investigation process itself, hard disks and file systems, data acquisition and duplication, and defeating anti-forensics techniques. This is the part that generalises: file system knowledge and sound acquisition method apply regardless of what you are investigating.
Platform forensics covers Windows, Linux and Mac, network forensics and malware forensics. Windows carries the most weight in practice simply because it is what most organisations run.
Environment forensics is the broadest group: web attacks, dark web, cloud, email and social media, mobile, and IoT. Cloud and IoT are the newer additions and the areas where the field is least settled.
Fifteen modules across four hours means the exam samples broadly rather than testing any one area deeply. That shapes how to prepare: recognising which tool and which method applies to a given scenario matters more than mastering any single platform.
Who Should Take CHFI?
CHFI fits incident responders who keep getting handed the evidence question, and IT security staff moving toward investigation work. It also fits people in law enforcement or legal support roles who need the technical grounding.
Be clear about the market first. Digital forensics roles are fewer than SOC analyst roles. They cluster around law enforcement, consultancies, large enterprises and specialist firms. Geography also matters more than it does for general security work. This is a certification worth taking when you have a specific role in mind, not as a broad career hedge.
If you want forensics knowledge without committing to the specialism, the incident response route through GCIH covers enough for most responder jobs. CHFI is the deeper option for people who want the investigation to be the job.
Exam Details
- Exam Code: 312-49
- Current Version: CHFI v11
- Number of Questions: 150
- Question Types: Multiple choice
- Time Limit: 4 hours
- Passing Score: Between 60% and 85%, depending on the exam form
- Modules: 15
The variable passing score is worth understanding rather than worrying about. EC-Council uses multiple exam forms and sets a cut score for each one based on its difficulty. A harder set of questions carries a lower threshold. You can’t know in advance which form you’ll get. The only sensible plan is to aim comfortably above the top of the range.
EC-Council doesn’t publish the exam price on the certification page. The price varies depending on whether you take official training or apply through eligibility. Check directly before budgeting.
How to Prepare
Get hands on with the tooling. The official programme ships 68 labs and around 70GB of prepared evidence files. That’s unusual, and it’s the most useful part of the package. Forensics is a practical discipline, and reading about disk imaging teaches very little.
If you’re self-studying, build your own evidence. Image a spare drive, plant artefacts, then recover them. Autopsy and The Sleuth Kit are free and cover a good share of what the exam describes.
Learn file systems properly. NTFS, FAT and ext structures underpin a large share of the questions, and candidates who skip them find the disk analysis material harder than it needs to be.
What Comes After CHFI?
CEH pairs naturally, since understanding the attack makes the artefacts easier to interpret. For deeper forensics, GIAC’s forensic certifications go further into disk and memory analysis than CHFI does.
On the response side, GCIH covers containment and recovery, which is the half of an investigation CHFI treats as someone else’s job.
Retired Army Chief Warrant Officer. Twenty years in cyber ops. Now in government consulting.