CHFI v11 Training – Computer Hacking Forensic Investigator
CHFI v11 teaches you to run a complete digital investigation, from evidence seizure to a court-ready report. Over five days you work through disk, operating system, network, cloud, mobile and IoT forensics using EC-Council's 68 official hands-on labs. Sessions run as live online classes, in person in Casablanca or on-site at your organization, in French or English, and finish with focused preparation for exam 312-49.
Follow a sound investigation methodology and keep the chain of custody intact
Acquire and image media while proving evidence integrity
Examine Windows, Linux and macOS file systems and artifacts
Defeat common anti-forensics techniques
Investigate network, web, email and malware incidents
Carry out cloud, mobile, IoT and dark web investigations
Write a clear, defensible forensic report
Program
Computer forensics in today's world
Stakes, roles and legal context
Investigation process
Phases, seizure and chain of custody
Hard disks and file systems
NTFS, ext and APFS structures
Data acquisition and duplication
Forensic images, hashing, live acquisition
Defeating anti-forensics
Steganography, wiping, encryption
Windows forensics
Registry, event logs, memory
Linux and Mac forensics
System and memory artifacts
Network forensics
Captures, logs, correlation
Malware forensics
Static and dynamic analysis
Investigating web attacks
Web server and WAF logs
Dark web forensics
Tor browser artifacts
Cloud forensics
AWS, Azure and GCP investigations
Email and social media forensics
Headers, tracing, online evidence
Mobile forensics
Android and iOS acquisition
IoT forensics
Connected devices and firmware
Prerequisites
Basic IT and cybersecurity knowledge
Some familiarity with computer forensics and incident response
Target audience
SOC analysts and incident response teams
Digital investigators and law enforcement officers
Auditors, legal technologists and compliance officers who handle digital evidence
System and network administrators
The exam
The CHFI exam (312-49) consists of 150 multiple-choice questions to answer in 4 hours. EC-Council runs several exam forms and sets a cut score between 60% and 85% for each one, according to its difficulty. You sit the exam through the EC-Council Exam Portal. Requirements for keeping the credential active are set by EC-Council, and we walk you through them when you enrol.
Preparation tips
Redo every lab and note which tools and artifacts you used
Know file system structures and key Windows registry locations by heart
Practise pacing: about 1 minute 30 per question
Frequently asked questions (FAQ)
How does CHFI differ from CEH?
CEH covers attack techniques and vulnerability discovery. CHFI picks up after the incident: it teaches you to collect, analyse and present digital evidence so that it holds up in front of management or a court.
Do I need CEH before CHFI?
No, CEH is not required. A solid grounding in IT, cybersecurity and incident response is enough, although CEH experience helps you recognise attacker traces faster.
How many labs are included?
Version 11 includes 68 hands-on labs spread across 15 modules, so most of the week is spent working on evidence rather than slides.
Can I take the exam online?
The exam is delivered through the EC-Council Exam Portal. We confirm the sitting options (remote or at a centre) when your voucher is activated.
Which roles does CHFI support?
Forensic analyst, CSIRT member, tier 2 or 3 SOC analyst, cybercrime investigator, or a consultant who handles post-incident investigations.