8140.study
← All certifications

Computer Hacking Forensic Investigator (CHFI)

EC-Council

EC-Council's digital forensics certification covering the forensic investigation process across disks, OS, network, malware, cloud, mobile, and IoT evidence.

We have a course for this

Built from this exam's published objectives. The first module is free.

EC-Council CHFI

Intermediate · 19 hrs

Baseline certification levels

This certification satisfies these DoD baseline levels — the IAT / IAM / IASAE / CSSP requirement many contracts still state. It's a separate question from the 8140 work roles above, and there is no official mapping between the two.

CSSP Infrastructure SupportCSSP Incident Responder

What this qualifies you for

Listed specifically for 1 work role — up to Intermediate proficiency. Because options cascade downward, a cert listed at Advanced also satisfies Intermediate and Basic for that role.

212Cyber Defense Forensics AnalystAnalyzes digital evidence and investigates computer security incidents to derive useful information in support of system/network vulnerability mitigation.Intermediate
Also listed for 14 Cyberspace Enablers roles — but so is every other certification

The Enablers matrix isn’t role-differentiated: the same certification options are listed for all 14 roles at every proficiency level. We verified that across all 14. So this is true, and it carries no information about this credential specifically — which is why it isn’t in the count above.

211 Forensics Analyst221 Cyber Crime Investigator711 Cyber Instructional Curriculum Developer712 Cyber Instructor731 Cyber Legal Advisor732 Privacy Compliance Manager751 Cyber Workforce Developer and Manager752 Cyber Policy and Strategy Planner801 Program Manager802 IT Project Manager803 Product Support Manager804 IT Investment/Portfolio Manager805 IT Program Auditor901 Executive Cyber Leader

Renewal

3year cycle120ECE credit per cycle

USD $80 annual EC-Council Continuing Education (CE) membership fee (approx. $240 over the 3-year cycle), in addition to submitting 120 ECE credits

This is the issuer’s clock. 8140 runs a second one — 20 hours of CPD a year, at every proficiency level, which applies even if you hold no certification at all. How that works

EC-Council publishes the 15 modules/objective areas without percentage weights on the official course page; all domains are recorded as weight 0 (unweighted). Third-party sources (EDUSUM) publish a 6-area percentage breakdown (Forensic Science 15%, Regulations/Policies/Ethics 10%, Digital Evidence 18%, Procedures/Methodology 17%, Digital Forensics 29%, Tools/Systems/Programs 11%); this is not published on the official EC-Council course page and was not used for the domain list. Passing score is not a fixed percentage; EC-Council uses multiple exam forms with a per-form cut score, stated as 60%-85%. Version 'v11' is per EC-Council/EDUSUM syllabus references (exam code 312-49v11); the official course page did not display an explicit version label at time of capture.

Source: EC-Council - Computer Hacking Forensic Investigator (CHFI) · dated 2026-07-17 · checked 2026-07-17

Verifying it

EC-Council publishes a lookup a third party can use without your involvement.

Candidate Name and Certification Number

Issuer lookupTrack this credential

EC-Council publishes the 15 modules/objective areas without percentage weights on the official course page; all domains are recorded as weight 0 (unweighted). Third-party sources (EDUSUM) publish a 6-area percentage breakdown (Forensic Science 15%, Regulations/Policies/Ethics 10%, Digital Evidence 18%, Procedures/Methodology 17%, Digital Forensics 29%, Tools/Systems/Programs 11%); this is not published on the official EC-Council course page and was not used for the domain list. Passing score is not a fixed percentage; EC-Council uses multiple exam forms with a per-form cut score, stated as 60%-85%. Version 'v11' is per EC-Council/EDUSUM syllabus references (exam code 312-49v11); the official course page did not display an explicit version label at time of capture.

Source: EC-Council - Computer Hacking Forensic Investigator (CHFI) · dated 2026-07-17 · checked 2026-07-17

Exam blueprint

Verified against EC-Council’s published outline.

312-49 · v11

Current

150 questions · 4 hours · passing score varies 60%-85% (cut score set per exam form)

Computer Forensics in Today's World
Computer Forensics Investigation Process
Understanding Hard Disks and File Systems
Data Acquisition and Duplication
Defeating Anti-Forensics Techniques
Windows Forensics
Linux and Mac Forensics
Network Forensics
Malware Forensics
Investigating Web Attacks
Dark Web Forensics
Cloud Forensics
Email and Social Media Forensics
Mobile Forensics
IoT Forensics

EC-Council publishes objective areas without percentage weightings, so none are shown.

EC-Council publishes the 15 modules/objective areas without percentage weights on the official course page; all domains are recorded as weight 0 (unweighted). Third-party sources (EDUSUM) publish a 6-area percentage breakdown (Forensic Science 15%, Regulations/Policies/Ethics 10%, Digital Evidence 18%, Procedures/Methodology 17%, Digital Forensics 29%, Tools/Systems/Programs 11%); this is not published on the official EC-Council course page and was not used for the domain list. Passing score is not a fixed percentage; EC-Council uses multiple exam forms with a per-form cut score, stated as 60%-85%. Version 'v11' is per EC-Council/EDUSUM syllabus references (exam code 312-49v11); the official course page did not display an explicit version label at time of capture.

Source: EC-Council - Computer Hacking Forensic Investigator (CHFI) · dated 2026-07-17 · checked 2026-07-17