EC-CouncilEC-Council Certified Hacking Forensics Investigator (CHFI)
The EC-Council CHFI credential shows that you can detect attacks, collect and preserve digital evidence and carry out forensic investigations that stand up to scrutiny. It is held by digital forensics analysts, incident responders, law enforcement specialists and security professionals.
The certification is earned through exam 312-49, a four-hour multiple-choice test on the investigation process, evidence acquisition, and operating system, network, cloud, email and mobile forensics. Candidates typically come from security or systems administration, and preparation follows the CHFI v11 curriculum with forensic tool labs, case-based exercises and practice questions.
Your path to certification
Prepare
Start from where you are; we help you assess your level.
Train
1 course with an instructor
Sit the exam
CHFI (312-49)
Stay current
Keep CHFI active by earning 120 continuing education credits in each three-year cycle and paying the annual continuing education fee.
Where do you sit the exam? At our test centre
CEH, CND, CHFI, CCT and ECIH exams are delivered through Pearson VUE at our Authorised Test Centre in Mazzeh. EC-Council delivers its other exams through its own ECC Exam portal, and we help you register for those.
Preparation courses
Renewal and validity
Under EC-Council's continuing professional education (CPE) scheme, previously called ECE, you log 120 credits for each certification within its three-year cycle through activities such as conferences, webinars, training, publishing or passing a newer exam version, and you pay an annual fee that extends the certificate year by year. Missing the requirements leads to suspension and then revocation, so check EC-Council's current CPE policy, as details change.
Let's plan your next step together.
Tell us the course or certification you have in mind and we'll send the outline, upcoming dates, fees and private-team options.