Hello, you are using an old browser that's unsafe and no longer supported. Please consider updating your browser to a newer version, or downloading a modern browser.
A reference guide to EC-Council's digital forensics certification as of October 2026: the six domains of exam blueprint v4, the 312-49 exam format, both eligibility routes, cost, renewal, career paths, and how CHFI compares to ECIH, CND and CompTIA CySA+. Written for anyone deciding whether CHFI fits their work or trying to pin down what the exam actually covers.
CHFI is EC-Council's digital forensics certification. The current program is CHFI v11, and you earn the credential by passing exam 312-49, which is 150 multiple-choice questions in four hours.
It teaches an investigator's method: searching and seizing, chain of custody, acquisition, preservation, analysis, and reporting of digital evidence, done so the results hold up in court. The v11 course runs 15 modules and 68 labs, starting with hard disks and file systems and moving through Windows, Linux, and Mac forensics to network, malware, web, dark web, cloud, email, mobile, and IoT investigations.
Accreditation comes from ANAB under ISO/IEC 17024, and EC-Council maps the credential to the NICE 2.0 framework. CHFI is issued and maintained by EC-Council, which publishes the exam blueprint (v4, effective April 10, 2024) and the candidate handbook (v6.3, issued September 21, 2026) that govern the current exam.
Get the authority right first, a warrant or consent, then document the scene.
Record every hand the evidence passes through, from seizure to court.
Capture volatile data first, then image the media with write protection on.
Hash and protect the original so every copy can be checked against it.
Work the image for artifacts, timelines, and traces the attacker tried to hide.
Write findings a manager, a lawyer, or a judge can follow.
Stand behind the work in court and explain how it was done.
Four things that set CHFI apart from security certifications that give forensics a single chapter.
EC-Council built CHFI from a job task analysis of digital forensics roles, and the exam gives a full domain (10%) to rules of evidence, search and seizure, and the laws that govern an investigation. That legal grounding is the difference between forensics and troubleshooting. Evidence that was collected well but can't be admitted doesn't help anyone.
Windows, Linux, macOS, Android, and iOS each get their own coverage, and the cloud module works through AWS, Azure, and Google Cloud. EC-Council's handbook calls CHFI a vendor-neutral course, and the tool list backs that up.
The v11 course comes with 68 labs, more than 600 forensic tools, and over 70 GB of crafted evidence files. EC-Council's handbook puts lab work at roughly half of training time.
EC-Council lists CHFI under DoD 8140 for three DCWF work roles: 211 Forensics Analyst, 212 Cyber Defense Forensics Analyst, and 221 Cyber Crime Investigator. Its August 2023 announcement described the recognition as intermediate level.
A vendor's list is not the matrix itself, so before you rely on CHFI for a federal or contractor position, confirm it on the current DoD 8140 Approved Qualifications Matrix at the DoD Cyber Exchange.
The certification, the 312-49 exam, and what it takes to keep CHFI current, as published by EC-Council and checked in October 2026.
EC-Council's CHFI handbook points holders toward ECIH, CEH, or the Certified Threat Intelligence Analyst (CTIA) for broader skills. It also notes that CHFI counts for 3 credits toward EC-Council University's Master of Security Sciences degree.
EC-Council Certified Incident Handler, exam 212-89: 100 questions in 3 hours across nine domains. The live-response half of DFIR, for investigations that start while the incident is still running.
EC-Council's Certified Threat Intelligence Analyst. Named in the CHFI handbook for holders who want to move from reconstructing what happened to tracking who is likely to try it next.
Certified Ethical Hacker, 125 questions over 4 hours. Knowing the attacker's tools from the inside makes their traces much easier to recognize on a disk image or in a packet capture.
CHFI expects you to know basic networking, operating systems, and security before the first module. Most candidates reach it after a foundation credential and some time in IT or security operations, and it leads into incident response, wider blue-team work, or leadership.
Build the baseline
The investigator seat
Two questions to answer before you commit: can you take the exam, and should you take CHFI specifically. Here's a straight answer to both.
You can apply to sit the exam directly.
Send EC-Council the exam eligibility application with your resume, show at least two years of information security work experience, and pay the non-refundable $100 application fee. EC-Council checks the experience with the supervisor you name, which takes 5 to 10 working days on average once your verifier responds. If you're approved, you buy the voucher from EC-Council and schedule exam 312-49.
Official training removes the requirement.
Complete official EC-Council training (Training Camp's CHFI boot camp qualifies) and you can sit the exam without the experience review or the application fee. The exam voucher comes with the course, so you can test as soon as class ends.
CHFI is written for people whose work ends in a report someone else will rely on, whether that's a manager, a lawyer, or a court. These are the roles EC-Council names for the credential, including the three DCWF work roles it lists under DoD 8140:
Acquires and examines disks, memory, and mobile devices, rebuilds the timeline, and writes up findings for whoever ordered the investigation. EC-Council names this role first for CHFI.
Runs in-depth investigations of computer-based crime and builds the evidence trail, from digital media to the logs tied to an intrusion. One of three DoD work roles EC-Council lists for CHFI. Confirm it on the current DoD 8140 matrix before relying on it.
Analyzes digital evidence from security incidents so the defenders can close the gap the attacker used. EC-Council lists CHFI for this role, and CompTIA CySA+ also maps to it.
Collects, examines, and preserves evidence with documented investigative techniques, often for law enforcement, military, or government cases that may end up in court.
Handles response and forensics together, grabbing volatile evidence before containment wipes it out and then working out how the attacker got in. EC-Council names this role for CHFI.
Runs the forensic lab or team: tool validation, quality assurance, case assignments, and the reports and testimony that go out under the team's name.
CHFI shares ground with several blue-team credentials. Here's how it lines up against EC-Council's own ECIH and CND and against CompTIA CySA+, using each issuer's published figures as of October 2026.
| CHFI | EC-Council ECIH | EC-Council CND | CompTIA CySA+ | |
|---|---|---|---|---|
| Issuer | EC-Council | EC-Council | EC-Council | CompTIA |
| Exam | 312-49: 150 multiple-choice, 4 hours | 212-89: 100 multiple-choice, 3 hours | 312-38: 100 multiple-choice, 4 hours | CS0-004: max 85 multiple-choice and performance-based, 165 minutes |
| Passing Score | 60% to 85%, varies by exam form | 60% to 85%, varies by exam form | 60% to 85%, varies by exam form | 750 on a 100 to 900 scale |
| Exam Cost | Voucher from EC-Council after approval (price not listed), plus $100 application fee | $450 voucher without training, plus $100 application fee | $550 remotely proctored voucher | $439 retail voucher |
| Experience | 2 years infosec, or official training | 1 year infosec, or official training | 2 years infosec, or official training | About 4 years recommended, none enforced |
| Renewal | 120 credits over 3 years, $80 annual fee | 120 credits over 3 years, $80 annual fee | 120 credits over 3 years, $80 annual fee | 60 CEUs over 3 years, annual CE fee |
| DoD 8140 | Listed by EC-Council for DCWF 211, 212, 221 (confirm on the current matrix) | Listed by EC-Council for DCWF 531 (confirm on the current matrix) | Listed by EC-Council for DCWF 511, 521, 531 (confirm on the current matrix) | Approved for 10 DCWF work roles, including 212 |
| Focus | Digital forensics and evidence handling, 6 domains, 15 modules | Incident handling and response, 9 domains | Network defense, 20 modules, 8 domains | Security operations, vulnerability management, response, reporting |
| Best For | Forensic analysts, investigators, DFIR staff | Responders, CSIRT staff, Tier 2 analysts | Network and infrastructure defenders | Generalist SOC analysts |
ECIH, CND and CySA+ facts are taken from the Training Camp guides for ECIH, CND and CySA+. CHFI and ECIH are the closest pair here. ECIH runs the incident, and CHFI works out what happened and proves it.
Certification Matchups: the published facts, strengths and weak spots of 33 certifications, side by side.
Our official EC-Council CHFI v11 boot camp runs five days, live and instructor-led, in person or online. It includes official EC-Council courseware, hands-on labs, practice test questions, your 312-49 exam voucher, an exam retake, and 180 days of one-on-one coaching after class. See the rest of our official EC-Council courses if you are planning a longer path.
Cybercrime casework, log and cloud evidence, eDiscovery, the companion ECIH exam, and how DoD 8140 approval actually works.
Two former incident response and ransomware negotiation professionals were sentenced in April 2026 for deploying BlackCat ransomware against U.S. companies. A hard look at insiders who knew which forensic artifacts get left behind, and the same ALPHV ransomware family the CHFI v11 malware module analyzes.
Why log analysis is the gap between holding a certification and being competent, with a practical walk through SIEM basics. Logs show up all over the CHFI blueprint, both as evidence and as the trail an attacker tries to erase.
In the cloud you can't pull a disk, so evidence comes from API logs, audit trails, and snapshots you planned for in advance. Useful background for the CHFI cloud module and its acquisition work in AWS, Azure, and Google Cloud.
A February 2026 federal ruling held that conversations with consumer AI tools are not privileged, which makes them discoverable. What that means for preservation and eDiscovery, a process the CHFI blueprint tests directly.
Attackers broke into exposed Web Help Desk servers and then installed Velociraptor, a legitimate forensic and endpoint visibility tool. Why an investigator has to tell authorized tooling apart from an intruder's copy of the same software.
A study plan for the 212-89 Certified Incident Handler exam, CHFI's closest sibling. Its first response and evidence preservation material overlaps with what CHFI tests on chain of custody and the investigation process.
How a certification lands on the DoD 8140 qualification matrix, what ANAB accreditation has to do with it, and why a vendor's own work role list is not the same thing as a listing. Read it before you count on CHFI for a 211, 212, or 221 position.
The 312-49 exam follows blueprint v4, in effect since April 10, 2024, with six domains weighted from 10 to 29 percent. Digital Forensics alone is 29 percent, so plan your study time around it. The CHFI v11 course teaches the material across 15 modules. Click any domain for what it covers.
Types of cybercrime, cyber attribution, indicators of compromise, and the problems investigators run into, anti-forensics included. Also the groundwork: forensic readiness, where forensics fits in the incident response plan, the investigator's role and code of ethics, order of volatility, and how databases, cloud, email, IoT, OT, malware, and the dark web work.
Rules of evidence, the best evidence rule, the Federal Rules of Evidence, ACPO principles, warrants and consent for search and seizure, and chain of custody. Laws and legal issues that shape an investigation, the CAN-SPAM Act, ISO standards, and ENFSI best practices for examining digital technology.
Types and characteristics of digital evidence and the storage it lives on, from HDDs and SSDs to RAID, NAS, and SAN. Boot processes and file systems for Windows, Linux, macOS, Android, and iOS, plus Windows event logs, IIS and Apache logs, encoding and hex analysis of file formats, WAFs, and SQL Server and MySQL storage.
The investigation process from lab setup and first response through search and seizure, evidence preservation, reporting, and testifying as an expert witness. Data acquisition methodology, the eDiscovery process and EDRM model, image examination and event correlation, and the basics of dark web and malware forensics.
The largest domain by a wide margin: defeating anti-forensics, analyzing Windows, Linux, macOS, Android, and iOS artifacts, and network, wireless, and web application forensics. It also covers database, dark web, email, cloud (Azure, AWS, Google Cloud), and IoT forensics, static and dynamic malware analysis, fileless malware, and forensics with Python.
Knowing which tool fits the job: file system analysis, imaging, carving, password cracking, steganography detection, and memory and registry tools across Windows, Linux, Mac, Android, and iOS. Plus the tools for MSSQL, MySQL, Azure, AWS, email, IoT, network traffic, web server logs, social media, insider threat, and blockchain investigations.
Official EC-Council training follows this module order. The badge on each row shows the day the module is taught in Training Camp's five-day boot camp, which moves malware forensics to day five alongside mobile and IoT.
Cybercrime and how it is investigated, digital evidence and eDiscovery, forensic readiness, the investigator's role, and the standards and laws that apply.
First response and the pre-investigation, investigation, and post-investigation phases, from lab setup and search and seizure to reporting and expert testimony.
HDD and SSD structure, boot processes and file systems for Windows, Linux, and macOS, RAID and NAS/SAN storage, encoding standards, and file format analysis.
Live and dead acquisition, acquisition formats and methodology, eDiscovery collection, write protection, validation, and preparing an image for examination.
File carving, deleted partition recovery, password cracking, steganography, alternate data streams, artifact wiping, encryption, and program packers.
Volatile and non-volatile collection, memory and registry analysis, Electron apps, web browsers, ShellBags, LNK files, Jump Lists, and Windows 11 event logs.
Volatile and non-volatile collection on Linux and Mac, memory forensics, Mac log files and directories, APFS analysis, and Spotlight metadata.
Event correlation, indicators of compromise in firewall, IDS, router, DNS, and VPN logs, traffic investigation, SIEM, and wireless attack investigation.
A controlled analysis lab, static analysis, suspicious PDF and Office documents, system and network behavior analysis, and ransomware analysis of BlackCat (ALPHV).
IIS and Apache log analysis, and investigating cross-site scripting, SQL injection, directory traversal, command injection, XXE, and brute-force attacks.
How the Tor Browser works, finding its traces on a system, and memory dump analysis to recover Tor Browser and email artifacts.
Shared responsibility, data storage and logs in AWS, Azure, and Google Cloud, and forensic acquisition of EC2 instances, Azure VMs, and GCP persistent disks.
How email moves, the steps of an email crime investigation, U.S. laws against email crime, and tracking activity on social media platforms.
Android and iOS architecture, cell site analysis, rooting and jailbreaking, logical and physical acquisition, JTAG, and app artifact analysis.
IoT architecture and threats, the IoT forensics process, smartwatch and Amazon Echo examinations, JTAG and chip-off analysis, and drone data.
Domains and weights reflect EC-Council's CHFI Exam Blueprint v4 (effective April 10, 2024), which also lists a question count for each sub-domain adding up to 150. Modules reflect the CHFI v11 course outline on eccouncil.org.
The questions candidates ask most often when researching the EC-Council Computer Hacking Forensic Investigator certification.
CHFI is EC-Council's digital forensics credential. The current program is CHFI v11, tested by exam 312-49, and it covers the full investigation process along with forensics on hard disks and file systems, Windows, Linux, and Mac systems, networks, malware, web applications, the dark web, cloud platforms, email, mobile devices, and IoT. It's built for people who have to work out what happened on a system and then prove it.
There are two routes. Official EC-Council training qualifies you to sit the exam with no experience review. Without training, you apply to EC-Council with at least two years of information security work experience, pay a non-refundable $100 application fee, and wait while EC-Council checks that experience with the supervisor you name. Training Camp's CHFI boot camp is official EC-Council training, and the exam voucher comes with the course.
Exam 312-49 is 150 multiple-choice questions in 4 hours, taken at an EC-Council (ECC) exam center or a Pearson VUE test center. You can mark questions and go back to review your answers before you end the test. EC-Council uses several exam forms, and the cut score depends on the form you draw, anywhere from 60% to 85%.
The exam follows CHFI Exam Blueprint v4, effective April 10, 2024, which has six domains: Forensic Science (15%), Regulations, Policies and Ethics (10%), Digital Evidence (18%), Procedures and Methodology (17%), Digital Forensics (29%), and Tools/Systems/Programs (11%). Digital Forensics carries nearly a third of the exam, so hands-on analysis of operating systems, networks, malware, and cloud evidence counts for more than memorized definitions.
As of October 2026, EC-Council doesn't list a standalone CHFI exam voucher price on its online store. Self-study candidates pay the $100 application fee and then buy the voucher from EC-Council once approved. EC-Council's own CHFI training packages start at $1,699 for on-demand study, and EC-Council says its training includes an exam voucher. Training Camp's boot camp includes the voucher in the course fee.
CHFI is valid for three years. To renew it you earn 120 continuing education credits within the three-year cycle, record them in EC-Council's Aspen portal, and pay the $80 annual continuing education fee. If you fall short, EC-Council suspends the certification for one year and revokes it if the credits still aren't in by the end of that year.
EC-Council lists CHFI under DoD 8140 for three DCWF work roles: 211 Forensics Analyst, 212 Cyber Defense Forensics Analyst, and 221 Cyber Crime Investigator. Its August 2023 announcement described the recognition as intermediate level. Before you rely on that for a federal or contractor position, confirm the current listing on the DoD 8140 Approved Qualifications Matrix at cyber.mil, because the matrix is what your component will check.
Both come from EC-Council and both are blue-team credentials, but they cover different moments. ECIH (exam 212-89, 100 questions in 3 hours) is about running an incident: triage, containment, eradication, and recovery. CHFI is about the investigation: acquiring evidence without altering it, analyzing it, and reporting findings that hold up in court. The two pair naturally, and EC-Council's CHFI handbook names ECIH as a next step.
CySA+ is CompTIA's broader security analyst credential. Its CS0-004 exam mixes multiple-choice and performance-based questions across security operations, vulnerability management, incident response, and reporting. CHFI goes much deeper on forensic investigation and tests it with 150 multiple-choice questions. For general SOC work, CySA+ covers more ground. CHFI is the better match when examining evidence is the job itself.
EC-Council names digital forensics investigators, incident response analysts, computer forensics examiners, cybersecurity consultants, and digital forensics managers. Under DoD 8140 it lists CHFI for Forensics Analyst, Cyber Defense Forensics Analyst, and Cyber Crime Investigator. The certification is also aimed at police and law enforcement, defense and military personnel, legal professionals, banking and insurance staff, system administrators, and IT managers.
It depends on your background. People who already work in a SOC, on a CSIRT, or in IT operations usually know the systems and mostly need EC-Council's investigation method, the legal material, and the tools. Newer candidates should allow more time and spend most of it on the Digital Forensics domain, which carries 29% of the exam. Training Camp's boot camp covers all 15 modules in five days, which works best when you already have basic IT and security experience.
If your work involves evidence, yes. CHFI is ANAB accredited under ISO/IEC 17024, listed by EC-Council for three DoD 8140 forensics work roles, and its v11 course goes past disk and memory work into cloud, mobile, IoT, and dark web investigations. It's less useful if you want a first security certification, where Security+ or CC fits better, or if your job is live response rather than investigation, where ECIH is the closer fit.
The current program is CHFI v11, and exam 312-49 follows CHFI Exam Blueprint v4, effective April 10, 2024. EC-Council reissued the candidate handbook as v6.3 on September 21, 2026, so check it for current exam policies before you register. The handbook also notes that the ANAB-accredited CHFI certificate doesn't carry a version number, so the v11 label belongs to the training program rather than the credential you earn.
Tell us where you are, whether that's weighing the certification, working out funding, or planning forensics training for an investigations team, and we'll help you map out the right path.