CHFI
Computer Hacking Forensic Investigator · EC-Council
The CHFI validates knowledge of the digital forensics process: evidence acquisition and preservation, analysis of Windows, Linux and macOS systems, networks, email, mobile devices, the cloud and malware, and writing findings that can stand up in court. It is accredited and recognised by the US DoD. Its strength is a structured view of the whole investigation; its limit is a multiple-choice exam, whereas forensic teams often prefer GIAC certifications (GCFA, GCFE) or tool-specific credentials.
- Exam
- Exam 312-49 (CHFI v11): 150 multiple-choice questions in 4 h, pass mark between 60% and 85% depending on the exam form.
- Exam price
- $650Remotely proctored voucher; retake US$399. Without official training, add a US$100 eligibility fee.
- Required experience
- Official EC-Council training, or two years of information security experience approved through an eligibility application (US$100, non-refundable).
- Validity and maintenance
- Valid 3 years: 120 continuing education credits (ECE) over the cycle and an annual fee of US$80.
- Format
- Multiple choice
- Recognition
- ISO/IEC 17024 accredited · DoD 8140 approved
Who is it for?
Incident responders, SOC analysts, investigators and IT staff who may have to collect and analyse digital evidence.
Domains covered
- Computer forensics investigation process
- Hard disks, file systems and data acquisition
- Countering anti-forensics techniques
- Windows, Linux and macOS forensics
- Network forensics and web attack investigation
- Dark web and email crime investigation
- Malware forensics
- Mobile and IoT forensics
- Cloud forensics
Belinda’s take
Information checked on 2 October 2026 against the official site. Prices exclude tax and training, and may change.
The certification names mentioned are trademarks of their respective owners. KrakenShield is not affiliated with any certification body and does not reproduce any exam question.
