Computer Hacking Forensic Investigator

Exam format

EC-Council logo

Computer Hacking Forensic Investigator Exam Format

CHFI

Everything the official exam blueprint specifies: question count, time limit, scoring and the weight each domain carries. The Computer Hacking Forensic Investigator (CHFI) certification is a premier professional credential designed to validate the expertise of digital forensic investigators. As cyber threats become increasingly sophisticated, the ability to identify, preserve, analyze, and present digital evidence is critical. This program covers the end-to-end forensic process, from the initial response and data acquisition to advanced techniques in network, malware, and cloud forensics. Candidates learn how to navigate complex legal frameworks and utilize industry-standard tools to reconstruct security breaches and criminal activities. The curriculum is meticulously designed to ensure that investigators can handle diverse digital environments, including mobile devices, IoT ecosystems, and cloud infrastructures, while maintaining the integrity of the chain of custody for judicial proceedings.

150 questions
240 min
85% to pass
10 domains

Exam facts at a glance

The published specifications for this certification.

SpecificationValue
Questions150
Time limit240 minutes (96s per question)
Passing score85% — 60% to 85% (cut score set by an expert panel and varies by exam form)
Domains10
LevelAssociate
Question bank here150 questions
Published format150 questions, 4 hours
SourceOfficial exam specification, published by the vendor

Official domain weights

The percentage of the exam each domain carries. Weight your revision by these numbers, not by what you find hardest.

DomainWeightTopicsPractice Qs
Digital Evidence9%
  • Types of Digital Evidence
  • Evidence Preservation
  • Metadata Analysis
  • +1 more
14
Forensic Science6%
  • Introduction to Forensic Science
  • Principles of Forensic Investigation
  • Criminal Law and Digital Evidence
9
Digital Forensics16%
  • File System Analysis
  • Operating System Forensics
  • Data Recovery
  • +1 more
24
Malware Forensics9%
  • Malware Detection
  • Reverse Engineering Basics
  • Behavioral Analysis
  • +1 more
14
Network Forensics11%
  • Packet Analysis
  • Network Traffic Investigation
  • Log File Analysis
  • +1 more
17
Cloud/IoT Forensics8%
  • Cloud Service Provider Logs
  • IoT Device Forensics
  • Mobile Forensics Integration
  • +1 more
12
Reporting & Testimony5%
  • Forensic Report Writing
  • Expert Witness Testimony
  • Presenting Findings in Court
7
Tools/Systems/Programs13%
  • Forensic Software Suites
  • Imaging Tools
  • Hex Editors
  • +1 more
19
Procedures and Methodology9%
  • Standard Operating Procedures
  • Search and Seizure
  • Legal Compliance
  • +1 more
13
Forensics Investigation Process14%
  • Investigation Planning
  • Evidence Acquisition
  • Chain of Custody
  • +1 more
21

The heaviest domain is Digital Evidence at 9%, and that is where lost points cost you the most. Certilum scores you per domain so you can see the difference between a knowledge gap and a formatting problem.

Note from the vendor record: Current version CHFI v11, exam code 312-49, delivered on the ECC EXAM portal. Self-study candidates need 2 years of infosec experience plus approval via a non-refundable US$100 eligibility application (official training waives that route). Voucher valid 1 year; ANAB-accredited and DoD 8140 approved. Official exam page

More about the Computer Hacking Forensic Investigator exam

Explore the rest of this page series: format, cost, difficulty, requirements and how to prepare.

Related certifications

Explore other certifications in the same category and see how they stack up.

Frequently asked questions

Everything you need to know about the Computer Hacking Forensic Investigator exam.