EC-Council certification practice
Practise Computer Hacking Forensic Investigator CHFI across all 13 official exam domains — Computer Forensics Investigation Process, Computer Forensics Fundamentals and Process, Storage Forensics and File System Analysis, Incident Response and First Responder Skills, and more — with original exam-style questions, full explanations, and wrong-answer analysis. Courseiva helps you prepare with realistic practice questions, topic-based revision, explained answers and structured study routes.
Ways to study CHFI
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
New here? Start with this
Start with a 25-question practice test
Covers all 13 domains · takes ~5 min · no account needed · shows your weak areas immediately
Key facts for the Computer Hacking Forensic Investigator CHFI exam.
Exam cost
$950 USD / ~£750
Duration
240 minutes
Question count
150 questions
Passing score
70%
Validity
3 years
Delivered by
EC-Council Exam Portal / Pearson VUE
Online proctored
Yes — available
Retake policy
14 days between attempts; fees apply
Question formats
The EC-Council Computer Hacking Forensic Investigator (CHFI) certification validates expertise in detecting cyber-attacks and legally extracting evidence for investigations. The v10 curriculum covers forensic investigation methodologies, disk and file system forensics, network forensics, malware forensics, mobile device forensics, and cloud forensics. It is recognized by law enforcement agencies, legal professionals, and enterprise security teams worldwide. CHFI equips professionals to handle post-incident investigations and present evidence in a court-admissible format.
Official prerequisite
Two years of information security work experience recommended; official EC-Council training waives the experience requirement.
Recommended experience
Solid understanding of networking, operating systems (Windows/Linux), and basic cybersecurity concepts.
2+ years in IT security or law enforcement with exposure to digital investigations.
Should you skip this exam?
Professionals focused purely on offensive security or those with no background in cybersecurity or IT.
Courseiva study tip
Focus heavily on forensic tools (Autopsy, FTK, EnCase, Volatility) through hands-on labs, and understand chain-of-custody procedures and legal admissibility standards.
UK salary range
£45,000–£75,000
US salary range
$70,000–$115,000
Job roles that cite CHFI v10
What certification to take next
The CHFI exam voucher costs approximately $950 USD. This fee is typically bundled when attending official EC-Council training.
Candidates must achieve a score of 70% or higher to pass the CHFI v10 exam.
The exam consists of 150 multiple-choice questions with a 4-hour (240-minute) time allowance.
CHFI covers computer forensics fundamentals, evidence acquisition, disk and file system forensics, operating system forensics, network forensics, web and email forensics, mobile device forensics, malware forensics, and cloud forensics.
CHFI is considered moderately hard. It requires both conceptual knowledge and hands-on familiarity with forensic tools and legal procedures, making pure memorization insufficient.
CHFI is valid for 3 years. Renewal requires 120 EC-Council Continuing Education (ECE) credits during the 3-year period.
Security professionals, incident responders, law enforcement officers, and IT managers involved in investigating cyber incidents and gathering digital evidence.
See how CHFI v10 stacks up against related certifications.
100% free — no account required
Everything on Courseiva for CHFI is free — no subscription, no trial, no email wall.
Courseiva Exam Intelligence
Data confidence: BuildingDerived from Courseiva's continuously updated practice dataset: 205 exam-style questions. Updated 2 July 2026.
Question difficulty mix
Average time per question: 81s
13
Exam domains
official blueprint domains covered by the bank
205
Questions
exam-style questions in the CHFI bank
Practice modes
Choose a mode that matches your current study phase. Use topic practice early on and mock exams closer to your exam date.
All CHFI Questions
Browse the full question bank organised by domain and difficulty.
Practice Test
Start a 20-question session with a full explanation after each answer.
Mock Exam
Simulate the real exam with a timed, full-length question set.
Quick 25
A 25-question warm-up — ideal for a short daily study session.
Flashcards
Reinforce key terms, commands, and protocol facts with flashcards.
Domain Practice
Focus exclusively on one exam domain to target your weakest area.
50-Question Set
Mid-length practice set covering all domains.
Exam guide
Start with a short practice session, review each missed answer, then return to the topics that caused mistakes.
Computer Hacking Forensic Investigator CHFI spans 13 official exam domains (Computer Forensics Investigation Process, Computer Forensics Fundamentals and Process, Storage Forensics and File System Analysis, and more). Questions test whether you can apply each objective in a realistic scenario, not just recall a definition.
Related practice questions
Use these internal links to move from the exam guide into focused topic practice pages.
Practise CHFI questions linked to Computer Forensics Investigation Process.
Practise CHFI questions linked to Computer Forensics Fundamentals and Process.
Practise CHFI questions linked to Storage Forensics and File System Analysis.
Practise CHFI questions linked to Incident Response and First Responder Skills.
Practise CHFI questions linked to Computer Forensics Lab.
Practise CHFI questions linked to Evidence Acquisition and Duplication.
Practise CHFI questions linked to OS and Network Forensics.
Practise CHFI questions linked to OS and File System Forensics.
Practise CHFI questions linked to Application, Email and Cloud Forensics.
Practise CHFI questions linked to Mobile and Malware Forensics.
Practise CHFI questions linked to Network and Cloud Forensics.
Practise CHFI questions linked to Database and Application Forensics.
Practice directory
Every practice set is a unique selection of questions — numbered tests, domain-focused sessions, and topic-specific quizzes.
Showing 8 of 17 tests. See all 17 CHFI practice tests →
Official blueprint
Target weak areas by practising questions from a single domain. Each domain page shows all questions, difficulty breakdown, and a focused practice session.
Practise CHFI questions in this domain →
Practise CHFI questions in this domain →
Practise CHFI questions in this domain →
Practise CHFI questions in this domain →
Practise CHFI questions in this domain →
Practise CHFI questions in this domain →
Practise CHFI questions in this domain →
Practise CHFI questions in this domain →
Practise CHFI questions in this domain →
Practise CHFI questions in this domain →
Practise CHFI questions in this domain →
Practise CHFI questions in this domain →
Practise CHFI questions in this domain →
Deep-dive questions
The most-searched CHFI questions — each with a detailed explanation, worked example, and full answer breakdown.
Term reference
These terms appear frequently in CHFI questions. Understanding them precisely reduces guessing and improves scores.
NTFS Forensics
NTFS Forensics is the practice of examining New Technology File System structures to recover evidence of user activity, hidden data, and deleted files for cybersecurity investigations.
RAM Analysis
RAM Analysis is the forensic examination of a computer’s volatile memory to uncover evidence of running processes, network connections, malware, and user activity that is lost when the system is powered off.
Wireshark Forensics
Wireshark Forensics is the use of packet capture files and analysis techniques to investigate network traffic for signs of security incidents, intrusions, or policy violations.
Memory Acquisition
Memory acquisition is the process of capturing the contents of a computer's volatile memory to preserve data for forensic analysis and incident response.
Forensic Investigation Process
The forensic investigation process is a structured series of steps used to collect, preserve, analyze, and present digital evidence from computers and networks for legal or internal purposes.
FAT File System Forensics
FAT File System Forensics is the practice of recovering and analyzing digital evidence from storage devices formatted with the File Allocation Table file system.
FTK Imager
FTK Imager is a free forensic imaging tool used to create exact copies of computer drives and storage devices for digital evidence analysis.
Chain of custody
Chain of custody is a documented process that tracks the handling, transfer, and possession of evidence or digital assets from the moment they are collected until they are presented in court or used in an investigation.
Learn the concepts
15 book-style chapters cover every CHFI objective in plain English. Read the theory here, then test it with practice questions.
Chapter 1
Overview of Computer Forensics and Investigation Process
12 min read
Chapter 2
Legal and Ethical Issues in Digital Forensics
12 min read
Chapter 3
Evidence Handling and Chain of Custody
12 min read
Chapter 4
Forensic Investigation Process and Methodology
12 min read
Chapter 5
Data Acquisition and Duplication Techniques
12 min read
Chapter 6
Forensic Tools and Laboratory Setup
12 min read
Chapter 7
Windows Forensics: File Systems and Artifacts
12 min read
Chapter 8
Linux and Mac Forensics
12 min read
Free study guide
The Courseiva CHFI study guide covers exam format, the official domain blueprint with weights, a structured study plan, and domain-specific tips for each section. Use it alongside practice questions to build both conceptual depth and exam confidence.
Sample questions
Original exam-style questions — not copied from any exam or dump site. Open a question for the full answer breakdown.
An investigator acquires an SSD from a laptop that has been turned off for 24 hours. The suspect recently deleted several incriminating files. Using a forensic imager, the investig…
An investigator needs to testify in court as an expert witness. Which of the following qualifications is MOST important for the court to accept their testimony?
A forensic analyst is examining a RAID 5 array consisting of three disks. One disk has failed and has been replaced. The array is rebuilt automatically. However, the analyst needs…
A forensic investigator examines a hard drive and needs to recover deleted files. Which tool is specifically designed for file carving by scanning raw data for file headers and foo…
A forensic analyst is examining an Android device that has been factory reset. Which type of data is LEAST likely to be recoverable using forensic tools?
Which type of evidence is a witness's statement that they saw someone log into a computer?
Related certifications
Studying for CHFI? These related EC-Council certifications share concepts and are common next steps.
All EC-Council certifications →Courseiva provides free Computer Hacking Forensic Investigator CHFI (CHFI) practice questions with original exam-style questions, detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics. Courseiva is an independent platform and is not affiliated with EC-Council.