Computer Hacking Forensic Investigator — Information & Free Practice
US · Examination information
100 free questions · Answer explanations · No signup required
Computer Hacking Forensic Investigator
- Provider
- VUE and EC-Council Test Centers
- Format
- Proctored multiple choice
- Exam questions
- Total questions: 150.
- Time limit
- 4 hours
- Passing score
- 60% to 85%, set separately for each examination form
Examination outline
Forensic Science (15%)
- Cybercrime types and forensic investigation challenges
- Computer forensics fundamentals and investigator roles and responsibilities
- Data acquisition concepts and rules
- Database, cloud, email, IoT, malware and dark web fundamentals
Regulations, Policies and Ethics (10%)
- Rules and regulations for search, seizure and examination of evidence
- Laws and legal issues affecting forensic investigations
- Computer forensics standards and best practices
Digital Evidence (18%)
- Characteristics and types of digital evidence
- Desktop and mobile operating systems
- Log types and importance to forensic investigations
- Encoding standards and file types
- WAF and MySQL database fundamentals
Procedures and Methodology (17%)
- Forensic investigation process
- Data acquisition methodology
- eDiscovery process
- Image and evidence examination and event correlation
- Dark web and malware forensics methodology
Digital Forensics (29%)
- Anti-forensic techniques and countermeasures
- Windows, Linux and Android file analysis
- Network logs and network attack investigations
- Web application logs and attack investigations
- Database, dark web, email, cloud and IoT forensics
- Static and dynamic malware analysis in a sandbox
- Malware behavior, persistence and fileless malware analysis
- Digital forensics using Python
Tools/Systems/Programs (11%)
- Tools for Windows, Linux, Mac, Android and iOS investigations
- Tools for MSSQL, MySQL, Azure, AWS, email and IoT investigations
- Tools for network, web application, cloud, social media and insider threat forensics
Examination sources
- CHFI Exam Blueprint v4
p. 1, cover; pp. 2-16, complete domain/subdomain/description/question/weightage table
- CHFI Candidate Handbook v6.3
p. 7, examination scope adoption
- CHFI Candidate Handbook v6.3
p. 48, Appendix A cover and effective date
- CHFI Candidate Handbook v6.3
p. 7, examination format
- Computer Hacking Forensic Investigator
Passing Criteria
- CHFI Candidate Handbook v6.3
p. 8, A. Completed Official Training
- CHFI Candidate Handbook v6.3
p. 8, B. Attempt Exam without Official Training
- CHFI Candidate Handbook v6.3
p. 9, Eligibility Process, f-g
- CHFI Candidate Handbook v6.3
p. 7, testing centers
- CHFI application process
CHFI, Eligibility Process, approved application and voucher validity
- CHFI application process
CHFI, Age Requirements and Policies Concerning Minors
- CHFI Candidate Handbook v6.3
p. 8, examination agreements
- CHFI application process
CHFI, official training eligibility
- EC-Council Testing at Pearson VUE
Scheduling
- CHFI application process
CHFI, training notes, official e-courseware
- CHFI application process
CHFI, Eligibility Process, additional information and experience verifier
- CHFI application process
CHFI, Important Notes, voucher matching warning
Related license preparation
This examination may be required or accepted as an alternative, depending on the license and application pathway.