DOD Civilian COOL Snapshot - Computer Hacking Forensic Investigator (CHFI)

Computer Hacking Forensic Investigator (CHFI)

Renewal Period: 3 years

The Computer Hacking Forensic Investigator (CHFI) credential is for professionals in the field of defense and military personnel, e-Business security professionals, systems administrators, legal professionals, banking, insurance, IT managers, government agencies, and police and other law enforcement personnel. The CHFI certification will ensure that participants have the necessary skills to identify an intruder's footprints and to properly gather the necessary evidence to prosecute in the court of law. Candidates that do not attend official training must have a minimum of two years of work experience in the Information Security domain to be eligible to sit for the exam.

More information can be found on the certifying agency's website.

Computer Hacking Forensic Investigator (CHFI)

The following DOD Civilian Occupations provide training and/or experience that contributes to attaining this credential:

The following Federal Occupations provide training and/or experience that contribute to attaining this credential:

	Federal Occupation	Related As
	2210 Information Technology Management Series	Other

MINIMUM REQUIREMENTS

Eligibility Requirements (View Details)

Credential Prerequisite
Experience: 2 years
Education
Training
Membership
Other
Fee

Note: This credential may have multiple options for becoming eligible. Listed are the minimum requirements based on the minimum degree required. To view other options, see the Eligibility tab.

Exam Requirements (View Details)

Exam
Written Exam
Oral Exam
Practical Exam
Performance Assessment

RECERTIFICATION SUMMARY

Renewal Period: 3 years

Continuing Education
Exam
Continuing Education OR Exam
Fee
Other

AGENCY CONTACT INFORMATION

International Council of Electronic Commerce Consultants (EC-Council)

101C Sun Avenue NE
Albuquerque, NM 87109

Phone: (505) 922-2882

Fax: (505) 341-0050
Email: Johanna.pirolo@eccouncil.org

Show All / Hide All

Education/Training and/or Experience REQUIREMENTS

Option 1:

Candidates may attend an official CHFI instructor-led training (ILT), computer-based training (CBT), online live training, academic learning or have been certified in a previous version of the credential.

Option 2:

Candidates who do not attend official training must have at least 2 years of work experience in the Information Security domain and an educational background that reflects specialization in Information Security.

Other REQUIREMENTS

The Computer Hacking Forensic Investigator (CHFI) credential has the following other requirements:

Candidates who do not attend the Computer Hacking Forensic Investigator Course must submit an Exam Eligibility Application Form and obtain authorization from EC-Council before attempting the exam.

Prior to attempting the exam, candidates are required to AGREE to:
- EC-Council Non-Disclosure Agreement terms
- EC-Council Candidate Application Agreement terms
- EC-Council Candidate Certification Agreement terms

Written Exam CHFI Exam V2.1

Forensic Science (15%)
- Computer Forensics Objective and Need
- Forensics Readiness
- Cyber Crime
- Web Applications and Webservers Attacks
- Email Crimes
- Network Attacks
- Forensics on Mobile Devices
- Cyber Crime Investigation
- Computer Forensics Investigation Methodology
- Reporting a Cyber Crime
- Expert Witness
Regulations, Policies and Ethics (10%)
- Searching and Seizing Computers with and without a Warrant
- Laws and Acts against Email Crimes
- Laws pertaining to Log Management
- Policies Pertaining to Mobile Forensics
- Laws and Acts against Email Crimes
- General Ethics While Testifying
Digital Evidence (20%)
- Digital Evidence
- Types of Digital Evidence
- Rules of Evidence
- Electronic Evidence: Types and Collecting Potential Evidence
- Electronic Crime and Digital Evidence Consideration by Crime Category
- Computer Forensics Lab
- Understanding Hard Disks
- Disk Partitions and Boot Process
- Understanding File Systems
- Windows File Systems
- Linux File Systems
- Mac OS X File Systems
- RAID Storage System
- File Carving
- Image Files
- Analyze Logs
- Database Forensics
- Email Headers
- Analyzing Email headers
- Malware Analysis
- Mobile Operating Systems
Procedures and Methodology (20%)
- Investigating Computer Crime
- Computer Forensics Investigation Methodology
- Digital Evidence Examination Process
- Encryption
- First Responder
- First Response Basics
- Roles of First Responder
- Data Acquisition and Duplication
- Defeating Anti-forensics Techniques
- Log Management and Event Correlation
- Network Forensics (Intrusion Detection Systems (IDS))
- Computer Forensics Reports and Investigative Report Writing
Digital Forensics (25%)
- Recover Data
- File System Analysis
- Windows Forensics
- Linux Forensics
- MAC Forensics
- Recovering the Deleted Files and Partitions
- Steganography and Image File Forensics
- Steganalysis
- Application Password Crackers
- Investigating and Analyzing Logs
- Investigating Network Traffic
- Investigating Wireless Attacks
- Web Attack Investigation
- Investigating Email Crime and Violation
- Mobile Forensic Process
- Cloud Forensics
- Malware Forensics
- Defeating Anti-Forensic Techniques
Tools/Systems/ Programs (10%)
- First Responder Toolkit
- Windows Forensic Tools (Helix3 Pro, X-Ways Forensics, Windows Forensic Toolchest (WFT), Autopsy, The Sleuth Kit (TSK), etc.)
- Data Acquisition Software Tools UltraKit Forensic Falcon, etc.)
- Tools to defeat Anti-Forensics
- Steganography Tools
- Database Forensics Tools
- Password Cracking Tools
- Network Forensics Tools
- Web Security Tools, Firewalls, Log Viewers, and Web Attack Investigation Tools
- Cloud Forensics Tools
- Malware Forensics Tools
- Email Forensics Tools
- Mobile Forensics Software and Hardware Tools
- Report Writing Tools

Exam Preparation Resources

There are a number of resources available to help you prepare for the Computer Hacking Forensic Investigator (CHFI) examination:

Best Sources

Testing Information

Testing for this credential is handled by Pearson VUE. The test centers are located in the U.S. They also have some test centers on military bases.

To find out more, use the following links on the Pearson VUE website:

For more information on the International Council of Electronic Commerce Consultants (EC-Council) testing process, visit the agency website.

RECERTIFICATION

Computer Hacking Forensic Investigator (CHFI)

Renewal Period: 3 years

The Computer Hacking Forensic Investigator (CHFI) credential has the following recertification information:

To renew the CHFI credential for another 3-year period, certificate holders need to update his or her EC-Council Continuing Education (ECE) credit account in the EC-Council Delta portal and submit proof of earned credits. To maintain certification, certificate holders must earn a total of 120 credits within 3 years of ECE cycle period.

The credits can be earned in many ways including attending conferences, writing research papers, preparing for training classes in a related domain (for instructors), reading materials on related subject matters, taking an exam of a newer version of the certification, attending webinars, and many others.

Computer Hacking Forensic Investigator (CHFI)

Computer Hacking Forensic Investigator (CHFI)

Computer Hacking Forensic Investigator (CHFI)

In Demand

COOL Bucks

COOL Summary

Some

Most

Other

Promotion Points

Star

Skill Level

Proponent Funded

Navy Bucks

CG Bucks

Early Career

Mid Career

Late Career

Early Career

Mid Career

Late Career

LaDR

GI Bill®

ANSI

ICAC

ABSNC

NCCA

IAS

Low

Medium

High

Army e-learning

NKO e-learning

GI Bill^®