
Exam format
Computer Hacking Forensic Investigator Exam Format
Everything the official exam blueprint specifies: question count, time limit, scoring and the weight each domain carries. The Computer Hacking Forensic Investigator (CHFI) certification is a premier professional credential designed to validate the expertise of digital forensic investigators. As cyber threats become increasingly sophisticated, the ability to identify, preserve, analyze, and present digital evidence is critical. This program covers the end-to-end forensic process, from the initial response and data acquisition to advanced techniques in network, malware, and cloud forensics. Candidates learn how to navigate complex legal frameworks and utilize industry-standard tools to reconstruct security breaches and criminal activities. The curriculum is meticulously designed to ensure that investigators can handle diverse digital environments, including mobile devices, IoT ecosystems, and cloud infrastructures, while maintaining the integrity of the chain of custody for judicial proceedings.
- 150 questions
- 240 min
- 85% to pass
- 10 domains
Exam facts at a glance
The published specifications for this certification.
| Specification | Value |
|---|---|
| Questions | 150 |
| Time limit | 240 minutes (96s per question) |
| Passing score | 85% — 60% to 85% (cut score set by an expert panel and varies by exam form) |
| Domains | 10 |
| Level | Associate |
| Question bank here | 150 questions |
| Published format | 150 questions, 4 hours |
| Source | Official exam specification, published by the vendor |
Official domain weights
The percentage of the exam each domain carries. Weight your revision by these numbers, not by what you find hardest.
| Domain | Weight | Topics | Practice Qs |
|---|---|---|---|
| Digital Evidence | 9% |
| 14 |
| Forensic Science | 6% |
| 9 |
| Digital Forensics | 16% |
| 24 |
| Malware Forensics | 9% |
| 14 |
| Network Forensics | 11% |
| 17 |
| Cloud/IoT Forensics | 8% |
| 12 |
| Reporting & Testimony | 5% |
| 7 |
| Tools/Systems/Programs | 13% |
| 19 |
| Procedures and Methodology | 9% |
| 13 |
| Forensics Investigation Process | 14% |
| 21 |
The heaviest domain is Digital Evidence at 9%, and that is where lost points cost you the most. Certilum scores you per domain so you can see the difference between a knowledge gap and a formatting problem.
Note from the vendor record: Current version CHFI v11, exam code 312-49, delivered on the ECC EXAM portal. Self-study candidates need 2 years of infosec experience plus approval via a non-refundable US$100 eligibility application (official training waives that route). Voucher valid 1 year; ANAB-accredited and DoD 8140 approved. Official exam page
More about the Computer Hacking Forensic Investigator exam
Explore the rest of this page series: format, cost, difficulty, requirements and how to prepare.
Related certifications
Explore other certifications in the same category and see how they stack up.
Frequently asked questions
Everything you need to know about the Computer Hacking Forensic Investigator exam.