Learn mode
Learn as you go
Choose an answer, reveal the key, and review available explanations, citations and candidate context.
25 questions free
Start guided practiceDigital forensics end to end: the investigation process and legal considerations, acquiring and analysing disk, memory, network and cloud evidence, and producing defensible reports.
Computer Hacking Forensic Investigator (CHFI) is EC-Council's professional-level cybersecurity certification, sat as exam 312-49. The exam runs for 4 hours and presents up to 150 questions, with a pass mark of varies by exam form (typically 60–85%). It costs US$1,199 at the standard rate.
The published exam guide lists 9 sections but does not assign public weightings, so plan to cover each in similar depth rather than betting on one being dominant.
Confirm these details on the official EC-Council page before booking — vendors adjust format and pricing without notice.
Some forms include unscored trial questions
Standard rate, before local taxes
The published exam guide for 312-49, in the vendor's own order.
01Computer Forensics in Today’s World
02Investigation Process
03Hard Disks and File Systems
04Data Acquisition and Duplication
05Anti-Forensics Techniques
06Windows, Linux and Mac Forensics
07Network and Web Forensics
08Cloud and Mobile Forensics
09Malware Forensics and Reporting
Official training or two years of documented information security experience.
Professional level — Advanced credentials covering design, scale and trade-off decisions.
Preview 25 supported questions before unlocking the 645-question 312-49 bank.
Community-contributedCompiled from publicly posted community exam discussions. Contributed by third parties rather than written here, so accuracy varies and most items carry no explanation. Progress and bookmarks stay in this browser.
Answer support: 44 explanations, 431 questions with candidate context and 3 questions with direct citations. Bank updated .
Choose an answer, reveal the key, and review available explanations, citations and candidate context.
25 questions free
Start guided practiceKeep answers hidden on the clock and review every miss only after you finish the public sample.
Free sample mock
Open timed mockWant the complete 645-question bank?
One Exam Pass unlocks this selected bank for 12 months with no renewal.
Compiled from exam discussions posted publicly by other people on ExamTopics. Copyright in each contribution rests with its original author; it is reproduced here for study. Not verified by us — most items carry no explanation. To request removal, see our content policy.
EC-Council lists up to 150 questions, to be completed in 4 hours. Question counts can vary slightly between exam forms, and unscored trial questions are sometimes included.
Varies by exam form (typically 60–85%). Confirm the current figure on the official exam page before booking, as vendors adjust cut scores when an exam form is refreshed.
The standard price is US$1,199. Local pricing, taxes and any retake policy vary by region, so check the official page for the figure that applies to you.
Official training or two years of documented information security experience.
The exam guide covers Computer Forensics in Today’s World, Investigation Process, Hard Disks and File Systems, Data Acquisition and Duplication and Anti-Forensics Techniques, plus 4 further domains. The full weighted breakdown is listed above.
Yes — this exam has 645 practice questions available here, each with the correct answer marked. They are community-contributed, compiled from exam discussions posted publicly by other people rather than written here, and most do not carry an explanation.