- CHFI's exam 312-49 has 150 questions in four hours, passing thresholds ranging 60%-85% by form.
- Digital Forensics (29%), Digital Evidence (18%), and Procedures and Methodology (17%) cover 64% of the exam.
- Self-study candidates pay a $650 voucher plus a nonrefundable $100 eligibility fee - $750 total before training.
- The first retake has no waiting period; a second failed attempt triggers a 14-day wait, up to five attempts per year.
What CHFI Actually Tests
The Computer Hacking Forensic Investigator credential, issued by EC-Council under exam code 312-49, validates the ability to identify, preserve, analyze, and report on digital evidence from compromised systems. It is not a penetration-testing or incident-response badge - it is built around the investigative and evidentiary side of security work: how evidence is collected without contaminating it, how it's documented, and how findings hold up under scrutiny.
If you're new to the credential entirely, start with our plain-language breakdown in What Is CHFI? before diving into study mechanics. For a fast orientation on terminology, CHFI Meaning and What Does CHFI Stand For? clear up common confusion, since the acronym is shared by unrelated credentials in other industries.
Registration and Fee Mechanics You Need to Plan Around
Before you open a single flashcard, map out the logistics - they affect your study timeline as much as content does. The exam voucher itself costs $650. If you're pursuing eligibility through the self-study route (documenting at least two years of practical information-security experience, verified by application) rather than official training, you also pay a nonrefundable $100 eligibility application fee. That brings your subtotal to $750 before any prep materials. If you go through official EC-Council training instead, that $100 fee is already folded into the training cost.
One detail that trips people up: purchasing courseware alone does not satisfy the official-training eligibility route. You either complete approved training or get your experience application approved. For the full monetary picture - including renewal costs - see CHFI Certification Cost 2026: Complete Pricing Breakdown. For eligibility specifics, read CHFI Requirements 2026: Eligibility, Prerequisites & How to Qualify.
Key Takeaway
Once your eligibility application is approved, you have three months to purchase the voucher, and the voucher stays valid for one year after that. Schedule your study plan against these windows, not an arbitrary calendar.
After certifying, CHFI runs on a three-year renewal cycle requiring 120 EC-Council Continuing Education (ECE) credits plus an $80 annual continuing-education fee. Factor this into your long-term cost planning - it's not a one-time expense. Exact scheduling windows and deadlines for the exam itself are covered in CHFI Exam Dates 2026: Testing Windows, Deadlines & Scheduling.
The Six Domains and Where to Focus Your Hours
The current blueprint (v4.0) organizes the exam into six domains, each weighted differently. Your study time should mirror these weights almost exactly - spending equal hours on a 10% domain and a 29% domain is the single most common first-attempt mistake.
| Domain | Weight | Study Priority |
|---|---|---|
| Digital Forensics | 29% | Highest - core analysis techniques |
| Digital Evidence | 18% | High - chain of custody, acquisition |
| Procedures and Methodology | 17% | High - investigation workflow |
| Tools/Systems/Programs | 11% | Moderate - tool-specific recognition |
| Forensic Science | 15% | Moderate - scientific foundations |
| Regulations, Policies and Ethics | 10% | Lower - legal/compliance context |
Digital Forensics (29%)
This is the largest domain by a wide margin and covers the practical analysis work: disk imaging analysis, file system artifacts, memory forensics concepts, timeline reconstruction, and recovering deleted or hidden data.
- Understand how artifacts differ across operating systems and file systems
- Be able to reason through a forensic scenario, not just recall a tool name
Digital Evidence (18%)
Focuses on how evidence is identified, collected, and preserved - chain of custody documentation, write-blocking, hashing for integrity verification, and evidence handling that would survive legal challenge.
- Know why improper acquisition can invalidate an entire investigation
- Understand hash verification's role in proving evidence wasn't altered
Procedures and Methodology (17%)
Covers the structured investigative process - from first response at a scene to report writing at the end. Expect scenario questions that test sequencing and judgment as much as terminology.
- Memorize the logical order of an investigation, not just isolated steps
- Pay attention to documentation requirements at each stage
For a domain-by-domain deep dive with more granular subtopics, see CHFI Exam Domains 2026: Complete Guide to All 6 Content Areas. If you want a compact reference you can review the night before the exam, bookmark the CHFI Cheat Sheet 2026: One-Page Review of Must-Know Facts.
How CHFI Questions Are Actually Written
All 150 questions are multiple choice - there is no separate hands-on lab component on exam day, even though training programs include labs to build the skills being tested. Questions generally fall into three patterns:
- Definitional recall: naming a concept, artifact type, or legal principle correctly.
- Scenario-based reasoning: given a short investigative situation, choosing the correct next step or correct interpretation of evidence.
- Tool/technique matching: associating a described forensic task with the category of tool or method used to perform it.
Because passing thresholds vary by form - anywhere from 60% to 85% depending on which version of the exam you receive - don't fixate on hitting one specific number. Focus on broad mastery across all six domains rather than trying to game a particular cutoff. For a full explanation of how these thresholds work, read CHFI Passing Score 2026: Exactly What You Need to Pass. If you're trying to gauge overall difficulty before committing to a study plan, How Hard Is the CHFI Exam? Complete Difficulty Guide 2026 breaks this down further, and CHFI Pass Rate 2026: What the Data Shows covers what's publicly known about outcomes.
A Domain-Weighted Study Timeline
Generic study techniques like spaced repetition or the Pomodoro method only help if they're applied against the right material at the right time. Below is a six-week structure that allocates time proportional to domain weight rather than treating all six domains equally.
Digital Forensics (29%)
- Study file system artifacts, timeline analysis, and data recovery concepts
- Work through scenario questions daily to build reasoning speed
Digital Evidence (18%) + Procedures and Methodology (17%)
- Master chain-of-custody documentation and evidence acquisition rules
- Sequence the full investigative workflow from response to reporting
Tools/Systems/Programs (11%) + Forensic Science (15%)
- Match tool categories to forensic tasks rather than memorizing brand names alone
- Review foundational scientific principles behind evidence handling
Regulations, Policies and Ethics (10%)
- Cover legal frameworks and ethical obligations - lowest weight but still tested
- Run full-length timed practice exams to test pacing across all domains
Integration and Review
- Retake weak-domain practice sets identified in earlier weeks
- Do a final pass through your one-page reference notes
This structure is a starting point - for the fully detailed version of this plan with daily breakdowns, see our primary guide at CHFI Study Guide 2026: How to Pass on Your First Attempt.
Retake Rules and Why First-Attempt Prep Matters
EC-Council's retake policy is more forgiving on the first miss than most candidates expect, but it tightens quickly after that. There is no waiting period before your first retake. Fail a second time, though, and you must wait 14 days before trying again. This 14-day wait applies to each subsequent attempt, up to a maximum of five attempts within a 12-month period. If you fail a fifth time, a sixth attempt requires waiting a full 12 months from the fifth attempt.
Key Takeaway
Because each attempt requires purchasing another exam voucher, treating your first sitting as the real attempt - not a "diagnostic" run - protects both your budget and your one-year voucher validity window.
This is exactly why domain-weighted preparation matters more than raw hours studied. A candidate who spends equal time on Regulations, Policies and Ethics (10%) and Digital Forensics (29%) is statistically misallocating almost a third of their prep time on the smallest domain. Use practice exams from our practice test site to identify which domains are actually costing you points before you sit the real 312-49 exam.
Who Hires CHFI Holders
CHFI is most relevant to roles centered on incident investigation and evidence handling rather than general security administration: digital forensic analysts, incident response investigators, law enforcement cyber units, corporate security teams handling internal investigations, and consulting firms performing breach forensics for clients. The credential signals that a candidate understands not just how a compromise happened, but how to document and preserve findings in a way that holds up to scrutiny.
For a closer look at the roles and hiring patterns tied to this credential, read CHFI Jobs. If you're still weighing whether the investment is worthwhile relative to your career goals, Is the CHFI Certification Worth It? Complete ROI Analysis 2026 and CHFI Salary Guide 2026: Complete Earnings Analysis lay out the considerations in more depth. For a general primer on the credential's structure and purpose, see CHFI Certification or What Is CHFI Certification?.
Frequently Asked Questions
The 312-49 exam contains 150 multiple-choice questions with a four-hour time limit - no separate hands-on practical component.
Self-study candidates pay the $650 exam voucher plus a nonrefundable $100 eligibility application fee, totaling $750 before any study materials. Official training bundles the $100 fee into its price.
Digital Forensics at 29% is the largest domain by far, followed by Digital Evidence at 18% and Procedures and Methodology at 17%. Together these three domains cover nearly two-thirds of the exam.
There's no waiting period for your first retake. A second failure triggers a 14-day wait, and this applies to each further attempt up to five total attempts within 12 months.
Once your eligibility application is approved, you have three months to purchase the voucher. The voucher itself remains valid for one year from purchase.