thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

EC-Council · Cybersecurity · Professional

EC-Council Computer Hacking Forensic Investigator (C|HFI) exam guide

Exam 312-49 (CHFI v11)

The Computer Hacking Forensic Investigator (CHFI) validates digital forensics skills across Windows, Linux, macOS, network, cloud, mobile, IoT and dark web investigations, with evidence handling suited to legal proceedings. It is approved under DoD 8140 for forensics roles.

Questions150
Time limit240 minutes
Passing score60-85% depending on exam form
Exam feeSee official page
Valid for3 years
DeliveryEC-Council exam portal (remote proctored) or Pearson VUE test center

Format: Multiple choice. Fee note: EC-Council sells the exam mainly bundled with training (packages from about $1,699 on demand); standalone voucher pricing varies by region and is not published on the certification page.

Who it's for

Incident responders, SOC analysts, law enforcement and IT staff moving into digital forensics.

What the exam covers

Computer Forensics Fundamentals and Investigation Process—
Hard Disks, File Systems, Data Acquisition and Anti-Forensics—
Windows, Linux and Mac Forensics—
Network Forensics and Investigating Web Attacks—
Malware and Dark Web Forensics—
Cloud, Email and Social Media Forensics—
Mobile and IoT Forensics—

A dash means the vendor does not publish a weight for that domain.

Eligibility & prerequisites

Required: Attend official EC-Council training, or apply for eligibility with relevant information security experience and the application fee.

Recommended: Basic knowledge of IT and cybersecurity, computer forensics and incident response.

Keeping it active

Valid 3 years. Maintain through the EC-Council Continuing Education (ECE) program: earn 120 ECE credits in the 3-year cycle and pay the annual ECE fee.

Skills & careers

Skills it validates

  • Forensic investigation process and chain of custody
  • Disk imaging and data acquisition
  • Windows, Linux and macOS artifact analysis
  • Network and web attack investigation
  • Malware forensics
  • Cloud, email, mobile and IoT forensics
  • Defeating anti-forensics techniques

Job roles

Digital Forensics AnalystIncident ResponderForensic InvestigatoreDiscovery SpecialistLaw Enforcement Cyber InvestigatorMalware Analyst

DoD 8140

Recognized in the DoD 8140 qualification matrix for cyber defense forensics and incident response work roles. Open the DoD Workforce Navigator

Where it fits in your path

Planning a degree too? See how this cert earns college credit in the College Credit Navigator.

Build my study plan

  1. Week 1: Forensics fundamentals, investigation process, legal and chain-of-custody rules.
  2. Week 2: Hard disks, file systems, data acquisition and anti-forensics.
  3. Week 3: Windows, Linux and Mac forensics with free tools (Autopsy, FTK Imager, Volatility).
  4. Week 4: Network, web, malware and dark web forensics.
  5. Week 5: Cloud, email, mobile and IoT forensics; timed practice exams.

Make it yours: pick your exam date and weekly hours. We'll split your time by domain weight and give you a printable plan.

Exam-day tips

  • Know file system structures (NTFS, FAT, ext4, APFS) and where key artifacts live.
  • Memorize Windows registry hives and common forensic artifacts.
  • Chain-of-custody and evidence-handling questions are common and easy points.
  • Know which tool fits each acquisition or analysis task.
  • 150 questions in 4 hours gives about 1.6 minutes each; pace evenly.

Key terms for this exam

All 43 terms Study with thinQcards™

Frequently asked questions

How much does CHFI cost?

EC-Council mainly sells CHFI with training, from about $1,699 for on-demand; standalone voucher prices vary by region.

How many questions are on CHFI?

150 multiple choice questions in 4 hours.

CHFI vs GCFA?

GCFA is more advanced and hands-on; CHFI is broader and cheaper and serves as an entry to forensics.

Does CHFI need CEH first?

No, but CEH or Security+ knowledge helps.

How do I renew CHFI?

Earn 120 ECE credits over 3 years and pay the annual ECE fee.

Official page: www.eccouncil.org. Reviewed November 2026. Vendors change fees and objectives, so confirm with the vendor before you book. Spot something out of date? Tell us.