CHFI Certification Guide: Exam Domains, Cost and Study Plan

The CHFI course outline and the CHFI exam blueprint are two different documents, and candidates who study from the first one without reading the second usually weight their time wrong. EC-Council teaches the Computer Hacking Forensic Investigator in 15 modules. It scores the exam across six domains, and one of those domains, Digital Forensics, carries 29 percent of the questions on its own. Nobody who works module by module at an even pace ends up spending 29 percent of their study time there. That mismatch is the first thing to fix in a CHFI study plan, and it is where this breakdown starts.

The rest of this guide covers what the 312-49 exam tests, how the cut score works (it is not a fixed number), what the certification costs over a three year cycle, where CHFI sits in the DoD 8140 qualification matrices, and how it compares to ECIH and CySA+ for people who already do incident work and want the forensics side of it on paper.

CHFI v11 is 150 questions in four hours, with a cut score EC-Council sets per exam form anywhere between 60 and 85 percent. Study to the blueprint weights, not the module list, and treat 85 percent on practice tests as the floor.

Preparing for the CEH exam? Compare class dates and formats for our CEH boot camp.

What does the CHFI certification cover?

The Computer Hacking Forensic Investigator (CHFI) is EC-Council’s digital forensics certification, currently at v11 under exam code 312-49, and accredited by ANAB under ISO/IEC 17024, which matters later when the DoD 8140 discussion comes up. Its scope is the full investigation lifecycle: seizing and imaging evidence, pulling artifacts out of Windows, Linux and macOS file systems, reconstructing network and web attacks from logs and captures, reverse engineering what malware left behind, and documenting all of it in a way that survives a courtroom.

It is a knowledge exam, not a practical. There is no lab component and no CHFI Master practical track the way CEH has one. Every question is multiple choice. That shapes how you prepare, because the exam rewards knowing which artifact lives where and which tool does what far more than it rewards being fast in Autopsy or FTK Imager. The hands on work still matters for the job, and the five day CHFI boot camp spends most of its lab time on it, but on exam day you are being tested on recall and procedure.

How is the CHFI exam scored?

EC-Council does not publish one passing score for CHFI. Its certification page states that cut scores are set on a per form basis and can range from 60 percent to 85 percent, depending on the difficulty of the specific question set a candidate draws. The practical consequence is that you cannot aim for 70 and feel safe. A harder form has a lower cut, an easier form has a higher one, and you do not know which form you have until the score report comes back. Prepare as if the cut is 85 percent, which is the top of the published range, and use practice scores the way Jeff Porch describes in his piece on what a practice test score actually means: as a map of weak domains, not as a prediction of the real number.

The weights below come from EC-Council’s published CHFI exam blueprint. These are the numbers to build a study calendar around.

Two things stand out. Digital Forensics plus Digital Evidence is 47 percent of the exam, 71 questions, and both domains draw heavily from the file system, operating system and acquisition modules. And Regulations, Policies and Ethics is only 10 percent, which surprises people who expect a forensics exam to be mostly about legal procedure. The legal content is real and you will see it, but it is 15 questions, not 50. Chain of custody, search authority and admissibility are memory items. Learn them cleanly and move on to the artifact work where the points are.

What are the 15 CHFI v11 modules?

The module list is how EC-Council organizes the course, and it is also the order most self study candidates follow. Grouped by what you would actually be doing during an investigation, it looks like this.

The weight of the exam sits in the Acquisition and Host Analysis groups. Modules 03 through 07 feed the Digital Forensics and Digital Evidence domains, and they are also the modules with the densest technical content: hex level file system structures, artifact locations that have to be memorized by path, and acquisition procedures with specific ordering. The specialized modules are broad rather than deep. You need to know what a Tor artifact looks like and which AWS log source answers which question, but you will not be asked to carve an APFS volume from a mobile image.

CHFI eligibility, cost and retake rules

There are two ways to be eligible. The training path is official EC-Council training through an accredited training center, iClass or an academic partner, and it carries no application step. The experience path requires a minimum of two years of information security work experience plus a $100 non refundable eligibility application fee. Approval under the experience path is valid for three months, and the exam voucher itself is good for one year from purchase. The EC-Council eligibility page has the application form and the current terms.

EC-Council does not publish a standalone CHFI voucher price on its public pages. Vouchers come bundled with training packages, and third party resellers list them at different prices, so treat any single voucher figure you see online as unverified. EC-Council’s own course pricing starts at $1,699 for on demand, $2,499 for live online and $3,299 for live in person, all including the exam. Voucher extensions went up in the July 2025 handbook revision: $49 buys three more months and $99 buys a year, where the previous handbook charged $35 for three months.

Retakes follow EC-Council’s standard policy. There is no waiting period before the first retake, then 14 days between each later attempt, with a maximum of five attempts in any 12 month period. A standard voucher does not include a free retake. The full set of test day rules, breaks and ID requirements is in the cross vendor exam day comparison if you want it side by side with CompTIA and ISC2.

How do you renew CHFI?

CHFI falls under EC-Council’s Continuing Education (ECE) policy. You need 120 ECE credits in each three year cycle, and the annual membership fee for a 312 series certification is $80. Credits have to be logged in the Aspen portal by February 1 of the following year. Miss that and the certification goes into suspension for up to 12 months, and after that it is revoked and you retest.

The credit values are generous for people who are actually working in the field. Earning another IT security certification is worth 40 credits. Attending a conference or seminar earns one credit per event. Publishing an article or white paper is 20. Teaching a new course is 21. The comparison of CPE requirements across certification bodies on this site covers how EC-Council’s cycle lines up against ISC2 and CompTIA if you are tracking more than one.

Does CHFI count for DoD 8140?

Yes, for three work roles. EC-Council announced in August 2023 that CHFI had been recognized under DoD Manual 8140.03 for the DCWF work roles 211 Forensics Analyst, 212 Cyber Defense Forensics Analyst and 221 Cyber Crime Investigator, all at the intermediate proficiency level. That recognition rests on the ANAB accreditation, which is the baseline requirement for a certification to appear in the qualification matrices at all.

It does not cover role 531, Cyber Defense Incident Responder. EC-Council maps that role to CEH, CND and ECIH instead. If your contract or billet is written against 531, CHFI alone will not satisfy it, even though the day to day work overlaps heavily. The DCWF work role map on this site lays out which certifications satisfy which roles, and the official matrices on cyber.mil are the document of record. Confirm the current revision there before you commit to an exam for a contract requirement, because the matrices are updated without much announcement.

CHFI vs ECIH vs CySA+: which one fits the job?

These three get compared because they all live in the blue team, post incident space, but they answer different questions. ECIH covers running the incident itself. CySA+ sits earlier in the timeline, on detection and the tooling a SOC operates every day. CHFI comes last, and its question is whether you can prove what happened in a form that holds up to a lawyer, an auditor or an insurer.

CHFI is the pick when the job title has forensics, investigator or eDiscovery in it, or when your organization needs someone who can produce evidence that will be challenged. ECIH makes more sense for someone joining a CSIRT who needs the handling process more than the disk work, and Jeff Porch’s ECIH guide covers that exam in the same detail. Anyone who has not worked in a SOC yet should start with CySA+, because it builds the detection foundation that forensics work assumes you already have.

One more comparison people ask about: CEH. CEH is the offensive side of the same house. It teaches how the attack was carried out so you can recognize it. CHFI picks up where CEH ends, with what the attack left behind. The two stack well for investigators, and the CEH v13 domain breakdown is the right companion read if you plan to hold both.

How to study for the CHFI exam

Start from the blueprint, not the courseware. Print the six domains with their question counts, then map each of the 15 modules to the domains it feeds. Modules 03 through 07 land mostly in Digital Forensics and Digital Evidence, so they get the biggest block of calendar. The first two modules feed Procedures and Methodology and Regulations, a combined 27 percent, and can be covered faster because the content is procedural rather than technical.

Then do the artifact work by hand, at least once per operating system. Image a small drive with FTK Imager and verify the hash. Open the image in Autopsy and find the registry hives, the prefetch folder, the event logs and the recycle bin metadata. Do the same on a Linux VM with ext4, and look at journaling and the authentication logs. Pull a memory capture and walk it through Volatility. Capture traffic in Wireshark during a simulated download and find the file in the stream. The exam is multiple choice, but the questions assume you have seen these artifacts, and candidates who have only read about them tend to confuse paths and tool outputs under time pressure.

Spend real time on Module 05. Anti-forensics questions are scenario based and sit across multiple domains. Know the difference between data hiding, artifact wiping and trail obfuscation, the common steganography tools, how timestomping shows up in the $MFT, and which secure deletion standards leave which patterns.

Finally, memorize the Tools, Systems and Programs domain as a list. It is only 11 percent, 16 questions, but they are nearly free points if you can match tools to functions: imaging tools, mobile extraction suites, memory analysis frameworks, email header analyzers, cloud log sources. That domain is where reading beats labbing, and it is the one place on this exam where a flash card deck is the right tool.

Frequently Asked Questions

How many questions are on the CHFI exam?

The CHFI v11 exam, code 312-49, has 150 multiple choice questions with a four hour time limit. There is no lab or practical component.

What is the passing score for CHFI?

EC-Council sets the cut score per exam form rather than publishing one number. Its certification page states the range is 60 percent to 85 percent depending on the difficulty of the question set you receive, so candidates should prepare for the upper end.

Do you need experience to take the CHFI exam?

Not if you complete official EC-Council training through an accredited training center, iClass or an academic partner. Without official training you need at least two years of information security work experience and must pay a $100 non refundable eligibility application fee.

How much does the CHFI certification cost?

EC-Council does not publish a standalone voucher price. Its own training packages that include the exam start at $1,699 for on demand and $2,499 for live online. Ongoing costs are an $80 annual membership fee and 120 ECE credits every three years.

Is CHFI approved for DoD 8140?

Yes. CHFI is recognized under DoD Manual 8140.03 for DCWF work roles 211 Forensics Analyst, 212 Cyber Defense Forensics Analyst and 221 Cyber Crime Investigator at the intermediate level. It is not listed for role 531 Cyber Defense Incident Responder.

How long is CHFI valid?

Three years. To keep it active you need 120 ECE credits per three year cycle, logged in the Aspen portal by February 1 of the following year, plus the $80 annual membership fee. Missing the deadline leads to suspension and then revocation.

Is CHFI harder than CEH?

They test different things. CEH is broader and covers attack techniques across many domains. CHFI is narrower but deeper on file system internals, acquisition procedure and artifact analysis, and its per form cut score can run as high as 85 percent. The technical modules on hard disks, Windows artifacts and anti-forensics carry the most questions and the densest material, which is where the difficulty concentrates.