Computer Hacking Forensic Investigator Certification | CHFI

Training in Cyber Security | Digital Forensics

The Computer Hacking Forensic Investigator (CHFI) course delivers the security discipline of digital forensics from a vendor-neutral perspective. CHFI is a comprehensive course covering major forensic investigation scenarios and enabling students to acquire necessary hands-on experience with various forensic investigation techniques and standard forensic tools necessary to successfully carry out a computer forensic investigation leading to the prosecution of perpetrators.

The CHFI certification gives participants (Law enforcement personnel, system administrators, security officers, defense and military personnel, legal professionals, bankers, security professionals, and anyone who is concerned about the integrity of the network infrastructure.) the necessary skills to perform an effective digital forensics investigation.

CHFI presents a methodological approach to computer forensics including searching and seizing, chain-of-custody, acquisition, preservation, analysis and reporting of digital evidence.

About the Computer Hacking Forensics Investigator Course

Course Outline

  • Computer Forensics in Today’s World
  • Computer Forensics Investigation Process
  • Understanding Hard Disks and File Systems
  • Data Acquisition and Duplication
  • Defeating Anti-forensics Techniques
  • Windows Forensics
  • Linux and Mac Forensics
  • Network Forensics

  • Investigating Web Attacks
  • Dark Web Forensics
  • Database Forensics
  • Cloud Forensics
  • Investigating Email Crimes
  • Malware Forensics
  • Mobile Forensics
  • IoT Forensics

CHFI captures all the essentials of digital forensics analysis and evaluation required for the modern world — tested and approved by veterans and top practitioners of the cyber forensics industry. From identifying the footprints of a breach to collecting evidence for a prosecution, CHFI handholds students through every step of the process with experiential learning. CHFI is engineered by industry practitioners for professionals including those such as forensic analysts, cybercrime investigator, cyber defense forensic analyst, incident responders, information technology auditor, malware analyst, security consultant, chief security officers and aspirants alike.

CHFI Course Benefits

  • Inclusion of critical modules in Darkweb forensic and IoT Forensics
  • Significant coverage of forensic methodologies for public cloud infrastructure, including Amazon AWS and Microsoft Azure
  • Massive updates on all modules in CHFI
  • Inclusion of latest forensic tools including Splunk, DNSQuerySniffer etc
  • Addition of new techniques such as Defeating Anti-forensic technique, Windows ShellBags including analyzing LNK files and Jump Lists

  • Extensive coverage of Malware Forensics (latest malware samples such as Emotet and EternalBlue )
  • Now more than 50GB of crafted evidence files for investigation purposes
  • More than 50% of new and advanced forensic labs
  • In-depth focus on Volatile and Non-volatile data acquisition and examination process (RAM Forensics, Tor Forensics, etc.
  • Accepted and trusted by cybersecurity practitioners across Fortune 500 globally.

  • Establish threat intelligence and key learning points to support pro-active profiling and scenario modeling
  • Perform anti-forensic methods detection
  • Perform post-intrusion analysis of electronic and digital media to determine the who, where, what, when, and how the intrusion occurred
  • Extract and analyze of logs from various devices like proxy, firewall, IPS, IDS, Desktop, laptop, servers, SIM tool, router, firewall, switches AD server, DHCP logs, Access Control Logs & conclude as part of investigation process.

  • Identify & check the possible source / incident origin.
  • Recover deleted files and partitions in Windows, Mac OS X, and Linux
  • Conduct reverse engineering for known and suspected malware files
  • Collect data using forensic technology methods in accordance with evidence handling procedures, including collection of hard copy and electronic documents

Passing Score

In order to maintain the high integrity of our certification exams, EC-Council Exams are provided in multiple forms (I.e. different question banks). Each form is carefully analyzed through beta testing with an appropriate sample group under the purview of a committee of subject matter experts that ensure that each of our exams not only has academic rigor but also has “real world” applicability. We also have a process to determine the difficulty rating of each question. The individual rating then contributes to an overall “Cut Score” for each exam form. To ensure each form has equal assessment standards, cut scores are set on a “per exam form” basis. Depending on which exam form is challenged, cut scores can range from 60% to 78%.

Number of Questions: 150

Test Duration: 4 Hours

Test Format: Multiple Choice

Test Delivery: ECC Exam Portal

  • Cyber Threat Analyst Tier 2
  • Cyber Threat Intelligence Analyst
  • Mid Level Penetration Tester
  • Cyberspace Analyst II
  • Cybersecurity Engineer II Red Team
  • Forensic Analyst, Senior
  • Cyber Security Analyst Advisor
  • Cyber Security Analyst
  • Application Security Analyst
  • Senior Cyber Security Analyst
  • Digital Forensics Analyst- Junior level
  • Security Architect
  • Cybersecurity Auditor
  • Senior Network Security Engineer
  • Information Security Engineer
  • Manager Information Security management
  • Principal Cyber Security Engineer
  • Information Security Risk Program Manager
  • Cybersecurity Systems Engineer
  • Information Assurance/Security Specialist
  • Principal Cyber Operator
  • Information Security Cyber Risk Defense Analyst
  • Senior Forensic Analyst
  • Director Information Technology Security
  • Cyber Security Intelligence Analyst

  • Penetration Tester
  • Sr. Information Assurance Analyst
  • Cyber Security Project Engineer
  • Cyber Threat Analyst II
  • Intrusion Analyst
  • Cyber Systems Administrator
  • Information Security and Risk Assessment Specialist
  • Forensic Analyst, Senior
  • CIS – Cyber and Network Security-Cloud Computing Faculty
  • Tier 2 Cyber Security Analyst
  • Sr. Network Security Engineering Specialist
  • Security Control Assessor 2
  • Security Operations Engineer / Team Lead
  • Principle Cyber Operator
  • Manager, Cyber Security Operations and Incident Response
  • IT Security Manager
  • Sr. Network Security Engineer
  • Senior IT Security Manager- Cloud & Digital
  • Senior Principle, Digital Forensics
  • Sr. Network Security Engineering Consultant
  • Sr. Cyber Threat Intel Analyst
  • Cyber Security Associate 3
  • Tier I Intrusion Analyst
  • Senior Investigative Analyst
  • Sr. Cybersecurity Consultant (Incident Response)

Choose your learning path:

Live Instruction
Video Training
Exam Retakes
Peer Interaction
Individual Pricing displayed,
Inquire for Multi Seat discount.
Live Instruction
Video Training
2 Video Courses
Exam Retakes
Peer Interaction
I'm Ready
Live Instruction
Video Training
Unlimited Video Courses
Exam Retakes
Peer Interaction
I'm Ready
Live Instruction
Video Training
1 Video Course
Exam Retakes
Peer Interaction
I'm Ready
I'm Ready I'm Ready I'm Ready
*If you fail the first attempt, EC-Council will pay for the retake.

Explore what is included with each of our training packages:

The Live Training Package Includes:

  • Live Course Delivered by an EC-Council Master Trainer
  • Official Printed Courseware (U.S. only)
  • Online Labs (6 months access)
  • Online Exam Prep Program
  • Certification Exam
  • Exam Retake – 1 qty
  • CHFI On-Demand Course (1 year access)

Don’t just take a class. Join a program.

The Computer Forensics course includes the complete EC-Council Certified Incident Handler (ECIH) course, including labs, exam and e-courseware, as well as three computer Forensic Deep Dives:

EC-Council’s Certified Incident Handler program equips students with the knowledge, skills, and abilities to effectively prepare for, deal with, and eradicate threats and threat actors in an incident.

In this workshop you will be given a tour of the dark web and walked through the technical details of how it works. You will get hands-on experience conducting dark web investigations.

In this Malware & Memory Forensics workshop, you will learn details of how malware functions, and how it is categorized. Then you will be shown details of the structure of memory, and how memory works.

In this workshop you will learn mobile phone architecture, how to use phone forensics tools and open-source tools. There will be a strong focus on Android phones, including how to use the Android Debugging Bridge to perform forensics.

This learning option includes the CHFI course as well as one year of unlimited access to EC-Council’s library of on-demand certification courses

Get Started

One Year Subscription


Access to EC-Council’s full library of on-demand courses

Official e-courseware


Certification exam*

Move to “enhance” to upgrade your experience.


During your subscription, you can upgrade to a live course for $499!

Official Printed Courseware


Certification exam*

Lastly, receive ongoing professional development by moving to the Continuing Education phase!

Continuing Education

Continue to learn and gather continuing education credits with EC-Council Pro!

Premium Content: 600+ Premium Online Cybersecurity Courses

Fresh Content: 15,000+ Lab Demos to Practice Your New Skills

EC-Council Pro course videos come with lab demos to reinforce course learning concepts and create a constant career learning companion.

Self-Paced Learning, Anytime, Anywhere.

On-Demand Training Includes:

  • CHFI Online Self-Paced Streaming Video Course (1 year access)
  • E-Courseware
  • CyberQ Labs (6 months)
  • Certificate of Completion
  • Certification Exam


Think you’re ready?

Have questions?

Ask a Training Consultant