Computer Hacking Forensic Investigator (CHFI) (312-49)

Validates knowledge of digital forensics, including evidence handling and analysis of disks, operating systems, networks, cloud and mobile.

Summary

CHFI is EC-Council's digital forensics certification, for security staff who want to add investigation skills. Its 150-question multiple-choice exam covers six domains, from evidence rules and investigation procedures to disk, network, cloud, mobile and malware forensics.

Good fit if

You want a broad grounding in digital forensics
You work in security and want to add investigation skills
Your employer uses EC-Council certifications or pays for training

Look elsewhere if

You do DFIR work and want more depth: GIAC GCFA
You want SOC analysis, not forensics: CySA+
You are new to IT and security: Security+

Salary & jobs

Average base salary with CHFI (US)

$118,000

Payscale CHFI certification survey (202 respondents)

Payscale: CHFI certification salary ↗

Prerequisites

Official training or 2 years of security experience

Required

EC-Council must confirm your eligibility before you can buy an exam voucher.

Official EC-Council training	Training from EC-Council, an accredited training center or an approved academic institution.
2 years of information security experience	Apply with proof of experience and a $100 non-refundable fee.

Buying the official e-courseware alone does not count as training; you still need an approved application before buying a voucher.

Cost

USD · Self-study route

Eligibility applicationRequired$100

Exam voucherRequired$650

Forensics labsExample: EC-Council Labs CHFI · 6 months ($199)$

Official coursewareExample: CHFI v11 e-Courseware ($650)$

What holders say

Practitioners rank GIAC forensics certifications higher

Practitioners recommend SANS certifications such as GCFE, or CFCE for law-enforcement work. One incident responder was told CHFI and similar options were weaker than the GCFA already held.

r/computerforensicsThread: which forensics certification to get (August 2026)

Renewal

CHFI is valid for three years and renews through EC-Council's continuing education program.

Validity: 3 years
Renewal requirement: 120 ECE credits per cycle
Annual fee: $80 USD

Conferences, webinars, training, writing and passing a newer version of the exam all earn credits. Register each year's credits by February 1. If you miss the requirement, the certification is suspended for up to 12 months and then revoked.

EC-Council ECE policy ↗

Alternatives

GCFA$999 required · Intermediate

Advanced forensics and incident response, tied to SANS training.

CySA+$439 required · Intermediate

Security analysis and incident detection for SOC roles.

CEH$1,050 required · Intermediate

EC-Council's ethical hacking certification, often paired with CHFI.

FAQ

How much does the CHFI exam cost?

The exam voucher is $650. On the self-study route you also pay the $100 eligibility application, so $750 in total. EC-Council's on-demand course with the exam costs $2,199.

Do I need CEH before CHFI?

No. CHFI has its own eligibility: official training or two years of information security experience.

What is the CHFI passing score?

EC-Council sets a cut score between 60% and 85% for each exam form, based on its difficulty.

Does CHFI expire?

Yes. It is valid for three years. Renew it with 120 ECE credits per cycle and an $80 annual fee.

Last updated October 2026