Become a Computer Hacking Forensic Investigator (C|HFI)


Become a Computer Hacking Forensic Investigator(CHFI)

Computer Hacking Forensic Investigator (C|HFI)

EC-Council’s Hacking Forensic Investigator (C|HFI) is the only comprehensive ANSI accredited, lab-focused program on the market that gives organizations vendor-neutral training in digital forensics. C|HFI provides its attendees with a firm grasp of digital forensics, presenting a detailed and methodological approach to digital  forensics and evidence analysis that also pivots around the Dark Web, IoT, and Cloud Forensics. The tools and techniques covered in this program will prepare the learner for conducting digital investigations using ground-breaking digital forensics technologies.

The program equips candidates with the necessary skills to proactively investigate complex security threats, allowing them to investigate, record, and report cybercrimes to prevent future attacks.

The course aligns with all the crucial forensic job roles across the globe.

It is an ANSI 17024 accredited certification program, mapped to the NICE 2.0 framework and approved by the U.S. Defense of Department (DoD) 8570.

How Will You Benefit?

A BREACH can be BRUTAL. Investing in building an expert in-house forensics team with C|HFI training and certification is a strategic move for enterprises looking to safeguard their stakeholders’ interests as well as their own. C|HFI empowers their existing team with applying the latest investigation practices.

Detailed Methodological Learning Approach

C|HFI presents a methodological approach to computer forensics including searching and seizing, chain-of-custody, acquisition, preservation, analysis and reporting of digital evidence.

Dark Web & IoT Forensics

The first certification program to offer  you  Dark Web and IoT Forensics modules.

Extensive Coverage on Malware Forensics

Covers latest malware samples like Emotet and Eternal Blue, also known as WannaCry.

Forensics Methodologies for Cloud Infrastructure

Master tools and techniques to ensure security across various cloud platforms — Amazon Web Services, Microsoft Azure Cloud, and Google Cloud platform.

50 GB of Crafted Evidence Files

C|HFI v10 provides you with 50 GB of crafted evidence files for investigation purposes which helps to have hands-on experience in evidence collection.

50+ Complex Labs

The only program that provides thorough learning with a simulated environment including 50+ complex labs to ensure you obtain must-have skills for your next job.

Lead the Digital Forensics Movement by Becoming A Computer Hacking Forensic Investigator with EC-Council

Program Information

Program Information

What's New in CHFI

Whats New in C|HFI?

CHFI v10 captures all the essentials of digital forensics analysis and evaluation required for the modern world — tested and approved by veterans and top practitioners in the cyber forensics industry. From identifying the footprints of a breach to collecting evidence for a prosecution, CHFI v10 handholds students through every step of the process with experiential learning. CHFI v10 is engineered by industry practitioners for professionals including those such as forensic analysts, cybercrime investigators, cyber defense forensic analyst, incident responders, information technology auditor, malware analyst, security consultant, chief security officers and aspirants alike.

CHFI Course Benefits

  • Inclusion Of Critical Modules In Darkweb Forensic And IoT Forensics
  • Significant Coverage Of Forensic Methodologies For Public Cloud Infrastructure, Including Amazon AWS And Microsoft Azure
  • Massive Updates On All Modules In CHFI
  • Inclusion Of Latest Forensic Tools Including Splunk, DNSQuerySniffer Etc
  • Addition Of New Techniques Such As Defeating Anti-Forensic Technique, Windows ShellBags Including Analyzing LNK Files And Jump Lists
  • Extensive Coverage Of Malware Forensics (Latest Malware Samples Such As Emotet And EternalBlue)
  • Now More Than 50GB Of Crafted Evidence Files For Investigation Purposes
  • More Than 50% Of New And Advanced Forensic Labs
  • In-Depth Focus On Volatile And Non-Volatile Data Acquisition And Examination Process (RAM Forensics, Tor Forensics, Etc.
  • Accepted And Trusted By Cybersecurity Practitioners Across Fortune 500 Globally.

Course Outline

Course Outline

Module 01: Computer Forensics in Today’s World
Module 02: Computer Forensics Investigation Process
Module 03: Understanding Hard Disks and File Systems
Module 04: Data Acquisition and Duplication
Module 05: Defeating Anti-Forensics Techniques
Module 06: Windows Forensics
Module 07: Linux and Mac Forensics
Module 08: Network Forensics
Module 09: Investigating Web Attacks
Module 10: Dark Web Forensics
Module 11: Database Forensics
Module 12: Cloud Forensics
Module 13: Investigating Email Crimes
Module 14: Malware Forensics
Module 15: Mobile Forensics
Module 16: IoT Forensics

Who is it for?

Who is it for?

The CHFI program is designed for all IT professionals involved with information system security, computer forensics, and incident response.

  • Police and other law enforcement personnel
  • Defense and Security personnel
  • e-Business Security professionals
  • Legal professionals
  • Banking, Insurance, and other professionals
  • Government agencies
  • IT managers
  • Digital Forensics Service Providers

About The Exam

About the Exam

The CHFI certification is awarded after successfully passing exam EC0 312-49. CHFI EC0 312-49 exams are available at ECC exam centers around the world.

Passing Score

In order to maintain the high integrity of our certification exams, EC-Council Exams are provided in multiple forms (i.e., different question banks). Each form is carefully analyzed through beta testing with an appropriate sample group under the purview of a committee of subject matter experts, ensuring that each of our exams is not only academically sound, but also has “real world” applicability. We apply an internal process to determine the difficulty rating of each question. The individual rating then contributes to an overall “Cut Score” for each exam form. To ensure each form has equal assessment standards, cut scores are set on a “per exam form” basis. Depending on which exam form is challenged, cut scores can range from 60% to 85%. Clause: Age Requirements and Policies Concerning Minors The age requirement for attending the training or the exam is restricted to any candidate that is permitted by his/her country of origin/residency. If the candidate is under the legal age as permitted by his/her country of origin/residency, they are not eligible to attend the official training or eligible to attempt the certification exam unless they provide the accredited training center/EC-Council a written consent/indemnity of their parent/legal guardian and a supporting letter from their institution of higher learning. Only candidates from a nationally accredited institution of higher learning shall be considered.
  • Number of Questions: 150
  • Test Duration: 4 Hours
  • Test Format: Multiple Choice
  • Test Delivery: ECC Exam portal


Making an informed decision is difficult, and that’s where EC-Council’s C|HFI brochure comes to your rescue. The Certified Hacking Forensic Investigator (C|HFI) credential is the most trusted digital forensics certification that employers worldwide value, and for good reasons. The comprehensive curriculum in the course aligns with all the crucial forensic job roles across the globe. It covers a detailed and methodological approach to digital forensics and evidence analysis that also pivots around Dark Web, IoT, and Cloud Forensics. When you successfully achieve the C|HFI certification, you will be equipped with every skill you need to conduct digital investigations using ground-breaking technologies. This is only an overview of C|HFI and what you will learn. For complete information, download the brochure now.

Why People Love C|HFI

Accreditations, Recognitions and Endorsements