thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Courses  /  EC-Council  /  EC-Council CHFI
Exam 312-49CHFI v11 EC-Council DoD 8140 / 8570College credit

EC-Council CHFI

Run a computer forensic investigation from first response to courtroom-ready report, across disks, operating systems, networks, cloud, mobile and IoT.

5 days, instructor-led In class or live online Class Hub + 90 days Military funding accepted DoD 8570: CSSP Infrastructure Support, CSSP Incident Responder Up to 4 college credits

Course overview

15 modulesEnd-to-end forensicsFrom investigation process to IoT forensics
150 questionsFour-hour examScenario-based, exam 312-49
DoD 8140Approved credentialFor cyber forensics work roles

thinQtank® Learning is offering a unique instructor-led training camp that gives students the knowledge and skills needed to run a computer forensic investigation end to end — acquiring and duplicating evidence without altering it, defeating anti-forensics, and analyzing what is left across Windows, Linux, macOS, networks, malware, web attacks, the dark web, cloud services, email, social media, mobile devices and IoT. Students work major forensic investigation scenarios with the standard tools, so the practice is on evidence rather than on slides.

This course also helps students prepare to take the EC-Council CHFI exam (312-49, version 11) — a credential approved by the US Department of Defense under directive 8140 for cyber forensics work roles.

Your certification path

Where this course sits: what to have first, and where it leads.

Course objectives

What you will be able to do by the end of the class.

Sound investigation processScope an investigation, document it and keep chain of custody intact.
Acquisition and duplicationAcquire disks and memory forensically without altering the original evidence.
Anti-forensicsDetect and defeat wiping, hiding, timestamp tampering and encryption.
Operating system forensicsPull and interpret artifacts from Windows, Linux and macOS systems.
Network, web and malware forensicsReconstruct attacks from traffic, logs, web servers and malware traces.
Cloud, email, mobile and IoTInvestigate evidence that lives in cloud services, mailboxes, phones and connected devices.

Who it is for

Who gets the most from this class, and what to know before you start.

Who should attend

  • Digital forensic analysts and examiners
  • Incident response team members who have to preserve evidence, not just contain a breach
  • Security consultants and ethical hackers adding the forensics discipline
  • Law enforcement officers and legal staff investigating digital crime
  • IT staff responsible for information system security and incident handling
  • Service members, veterans and military spouses using AF COOL, Army Credentialing Assistance, MyCAA or VET TEC 2.0
  • Anyone in a DoD 8140 cyber forensics work role that requires an approved credential

Prerequisites

  • Introductory to intermediate experience in computer forensics
  • A working understanding of operating systems, file systems and networking
  • Our CEH camp is strongly recommended before this one — EC-Council recommends the same

Course outline

9 modules. Open any one to see what it covers.

01Forensics and the investigation process
  • Computer forensics today
  • Investigation process and chain of custody
  • Legal and reporting considerations
02Hard disks and file systems
  • Disk structures and partitions
  • Windows, Linux and macOS file systems
  • What survives deletion
03Data acquisition and anti-forensics
  • Acquisition and duplication methods
  • Write blocking and verification
  • Defeating anti-forensics techniques
04Operating system forensics
  • Windows artifacts and memory
  • Linux forensics
  • macOS forensics
05Network forensics
  • Traffic capture and analysis
  • Log correlation
  • Reconstructing incidents
06Malware and web attack forensics
  • Malware behavior analysis
  • Investigating web attacks
  • Server-side evidence
07Dark web and cloud forensics
  • Dark web investigation
  • Cloud evidence and provider cooperation
  • Multi-tenant challenges
08Email, social media and mobile
  • Email headers and attribution
  • Social media investigations
  • Mobile device forensics
09IoT forensics and reporting
  • IoT and embedded device evidence
  • Writing the forensic report
  • Exam review for 312-49

The full lesson-by-lesson outline is in the course datasheet (PDF).

Course features

How the class is taught, and why it works.

Live, instructor-ledEvery session is taught live by a certified instructor, in the classroom and online at the same time.
Hands-on labsLabs are built into the modules so you practise what you learn.
Exam preparation built inPractice questions and focused review aligned to exam 312-49.
Class Hub for 90 daysRecordings, materials and practice stay open for the class plus 90 days after it ends.
Attend your waySterling, VA, Atlanta, GA, Burbank, CA, or live online from anywhere.
Funding friendlyMilitary flat rate, thinQflex monthly payments, or a formal quote for your employer.

What you get

Everything below is included in the course price.

Class Hub access for the length of the class plus 90 days
thinQtank® Learning Accelerated Custom Exam Study Guide for the 312-49 exam
Exam delivery in classroom with 98% success
Custom and focused exam preparation software and materials
Course specific thinQtank® Learning publications to promote a fun and exciting learning
Membership to the thinQtank® Learning University Online
WE DO NOT "TEACH THE TEST" - Students will receive valuable examples and discussion
Receive all reading material and study guides when you register
All courses taught by certified instructors
Additional hours of remote lab access
Custom video recordings with even more in-depth learning of course topics
Customized practice exam software
Digital courseware
Retake any or all portions of the course as many times as you like in person or live on-line for 24 months
Six months mentoring access to our engineers after completing the course

Study plan

How the 5 days run, plus what to do before and after class.

Before class
  • Check the prerequisites above and fill any gaps
  • We send joining details and course materials before day one
Day 1
  • Forensics and the investigation process
  • Hard disks and file systems
Day 2
  • Data acquisition and anti-forensics
  • Operating system forensics
Day 3
  • Network forensics
  • Malware and web attack forensics
Day 4
  • Dark web and cloud forensics
  • Email, social media and mobile
Day 5
  • IoT forensics and reporting
  • Final review and exam strategy
After class
  • Class Hub stays open 90 days: recordings, labs and practice
  • Book your exam while the material is fresh

The order of topics can shift with the class; your instructor confirms the schedule on day one.

The certification exam

EC-Council Computer Hacking Forensic Investigator (CHFI v11) · exam 312-49

Exam code312-49
Questions150
Time4 hours
Passing scoreSet per exam form, 60%–85%
Format
Scenario-based multiple choice
Voucher
Exam voucher available through thinQtank for $1,199
Validity
Valid for three years, maintained with 120 EC-Council continuing education credits

DoD 8140 and college credit

What this certification counts for with the Department of Defense, and toward a degree.

DoD 8140 / 8570 CHFI qualifies for 2 of the 14 DoD workforce categories.
Cybersecurity Service Provider Infrastructure Support CSSP Infrastructure Support
3–6 years typicalGS-11 to GS-12
Sensor / tool administrator · IDS-IPS engineer · SIEM engineer · Defensive infrastructure support
Typically performs (DCWF): 521 Cyber Defense Infrastructure Support Specialist
Cybersecurity Service Provider Incident Responder CSSP Incident Responder
3–7 years typicalGS-12 to GS-13
Incident responder · DFIR analyst · CIRT member · Digital forensics examiner
Typically performs (DCWF): 531 Cyber Defense Incident Responder; 212 Cyber Defense Forensics Analyst

DoD 8570 was replaced by DoD 8140 work roles (contractors since February 2026), but job postings still use these categories. DoD publishes no crosswalk between the two; the work roles shown are what this population typically performs, not an official mapping. Experience figures are typical, not requirements.

College credit Pass the exam and these universities will count it toward a degree. This is what each school publishes about its own transfer policy; the registrar makes the final call.
3credits UMGC
Accepted WGU amount not published
4credits Charter Oak
Accepted Purdue Global amount not published
3creditsACE recommendationaccepted by 1,500+ schools

Worth knowing: EC-Council CHFI (award window closes 31 Dec 2026). Submit it to your school before then.

Most schools only count IT certifications earned in the last three to five years (some require them to be current), and several will not award transfer credit once you have enrolled. Get your evaluation done first.

Where it can take you

Roles this certification is commonly asked for.

Digital Forensic AnalystAcquire and analyze evidence for internal or legal investigations.
Incident ResponderPreserve evidence while containing a breach.
Law Enforcement Cyber InvestigatorInvestigate digital crime to an evidential standard.
eDiscovery SpecialistCollect and process electronic evidence for litigation.
DoD Cyber Forensics RolesMeets DoD 8140 credential requirements for forensics work roles.

Upcoming dates

Every class runs in the classroom and live online at the same time. Pick the dates; choose how you attend when you register.

DatesLocationFormat
Nov 16 – 20, 2026 Sterling, VA Classroom + live online Reserve
Nov 30 – Dec 4, 2026 Atlanta, GA Classroom + live online Reserve
Dec 7 – 11, 2026 Burbank, CA Classroom + live online Reserve
Jan 4 – 8, 2027 Sterling, VA Classroom + live online Reserve
Jan 25 – 29, 2027 Atlanta, GA Classroom + live online Reserve
Feb 1 – 5, 2027 Burbank, CA Classroom + live online Reserve
Mar 1 – 5, 2027 Sterling, VA Classroom + live online Reserve
Mar 15 – 19, 2027 Atlanta, GA Classroom + live online Reserve
Mar 29 – Apr 2, 2027 Burbank, CA Classroom + live online Reserve
Apr 26 – 30, 2027 Sterling, VA Classroom + live online Reserve
May 10 – 14, 2027 Atlanta, GA Classroom + live online Reserve
May 24 – 28, 2027 Burbank, CA Classroom + live online Reserve

11 more dates through December 2027. Ask about a later date.

Paying for it

The price above is our standard rate. These options can bring it down or spread it out.

Military & veterans
$1,500

Flat rate per class when you use Air Force COOL, Army Credentialing Assistance, MyCAA or VET TEC 2.0. Your program confirms eligibility.

Funding details
thinQflex™
Name your price

Paying yourself? Tell us what you can pay and over how many months, up to twelve. We say yes, or come back with terms.

Make an offer
Employer or agency
Formal quote

A formal quote with the course and exam voucher as separate lines, valid 30 days. Group and government pricing available.

Request a quote

How to enroll

Four steps from here to certified.

  1. Pick your datesChoose a class from the dates above, in a classroom or live online.
  2. Reserve or get a quoteReserve your seat, ask for a quote for your employer, or make a thinQflex offer.
  3. Get readyWe confirm your seat and send joining details and materials before day one.
  4. Attend and certifyTake the class, then sit exam 312-49, with Class Hub open for 90 days after.

Frequently asked questions

Should I take CEH first?
It is strongly recommended, and EC-Council recommends the same. CHFI assumes you understand how attacks work.
Is the voucher included?
No. A 312-49 voucher is available through thinQtank for $1,199; ask when you register and we add it.
Which tools will I use?
Standard forensic tools across major investigation scenarios, so you practice on evidence rather than slides.
What does it cost?
The standard price is $2,850; exam voucher available through thinQtank for $1,199. Military students using AF COOL, Army CA, MyCAA or VET TEC 2.0 pay $1,500, and thinQflex lets you name your own price and monthly payment.
How long is the class?
5 days of live, instructor-led training.
Can I attend live online?
Yes. Every class runs live online at the same time as the classroom, with the same instructor and labs.
How long do I keep access to the materials?
Your Class Hub stays open for the length of the class plus 90 days.
Can I use military funding?
Yes. With Air Force COOL, Army CA, MyCAA or VET TEC 2.0 you pay a flat $1,500 per class.
Can my employer pay?
Yes. Request a quote and we will send a formal one, valid for 30 days.
What if I cannot pay all at once?
Use thinQflex to name your price and spread payments over up to twelve months.
Where are the classrooms?
Sterling, Virginia; Atlanta, Georgia; and Burbank, California. Every class also runs live online, so you can join from anywhere.
What do I need to attend online?
A computer with a reliable internet connection, a headset or speakers, and a microphone. A webcam is recommended.
Will I get a certificate of completion?
Yes. You receive a thinQtank Learning certificate of completion when you finish the class.
Which course should I take next?
Most students go on to EC-Council Certified Ethical Hacker, EC-Council Certified Incident Handler (ECIH) v3, Cisco CCNP Cybersecurity - Conducting Forensic Analysis and Incident Response Using Cisco Technologies for Cybersecurity (CBRFIR). Tell us your goal and we will map the path with you.
Do you run private classes for teams?
Yes. We deliver private classes on-site or online for teams and agencies, on your dates. Ask for a quote.
Can you help me choose the right course?
Yes. Call 855-868-4467 or email sasmith@thinqtanklearning.com and we will recommend the right starting point.

Ready to earn your CHFI?

Next class Nov 16 – 20, 2026 · Sterling, VA and live online.