The Computer Hacking Forensic Investigator (CHFI) program trains professionals to detect cyber intrusions, preserve digital evidence, and conduct structured forensic investigations that support legal, regulatory, and organizational actions. Through hands‑on, real‑world techniques, learners gain the skills needed to recover deleted, encrypted, or damaged data and analyze digital artifacts across systems, networks, cloud, and mobile environments. This program, delivered through accredited school partners, prepares participants to sit for the EC‑Council EC0‑312‑49 exam and earn CHFI certification.
Module 1: Computer Forensics in Today’s World
Fundamentals of digital forensics and cybercrime landscapes
Module 2: Forensic Investigation Process & First Response
Investigation methodologies, evidence handling, and first‑responder procedures
Module 3: Searching, Seizing, and Preserving Digital Evidence
Legal considerations, chain of custody, and evidence integrity
Module 4: Hard Disks, File Systems, and Data Recovery
File systems, deleted files, deleted partitions, and data remnants
Module 5: Operating System Forensics (Windows Focus)
OS artifacts, logs, registry analysis, and user activity
Module 6: Data Acquisition, Duplication, and Anti‑Forensics
Forensic imaging, hashing, and defeating anti‑forensics techniques
Module 7: Network and Web Forensics
Network traffic analysis and investigation of web‑based attacks
Module 8: Database, Cloud, and Malware Forensics
Cloud investigations, database artifacts, and malware evidence analysis
Module 9: Email and Mobile Device Forensics
Email crime investigation and mobile device data acquisition
Module 10: Forensic Tools and Investigative Reporting
Hands‑on use of AccessData FTK, EnCase, and professional forensic reporting
Following completion of this program, the learner will be able to:
Explain the role of computer forensics in modern cybercrime investigations.
Apply structured forensic investigation processes and first‑responder procedures.
Conduct lawful search and seizure of digital systems while preserving evidence integrity.
Acquire, analyze, and recover deleted, hidden, or encrypted data from file systems and partitions.
Perform Windows, network, cloud, database, malware, email, and mobile forensics.
Utilize industry‑standard forensic tools including AccessData FTK and EnCase.
Detect and counter anti‑forensics techniques used to conceal malicious activity.
Produce professional investigative reports suitable for legal and audit purposes.
The CHFI certification is awarded upon successfully passing the EC0 312‑49 exam. The CHFI EC0 312‑49 exam is delivered through EC‑Council (ECC) authorized exam centers worldwide via the ECC exam portal.
CHFI Exam Details
Number of Questions: 150
Duration: 4 hours
Format: Multiple choice
Delivery Method: ECC exam portal
Passing Score
EC‑Council maintains the integrity and rigor of its certification exams by offering multiple exam forms, each drawn from different question banks. Every exam form is evaluated through beta testing and reviewed by a committee of subject matter experts to ensure both academic rigor and real‑world applicability.
Each question is assigned a difficulty rating, which contributes to a form‑specific cut score. To ensure consistent assessment standards across all versions, passing scores are set on a per‑form basis. As a result, the required passing score may range from 60% to 78%, depending on the exam version administered.
This course is offered in English, French, Spanish, German, Italian, Portuguese, Hindi, and Arabic.
This class is an independent-study course. Students will have all the resources needed to successfully complete the course within the online material. A student helpdesk is available for technical support during the course enrollment.