CHFI study guide · 2026

The 6 CHFI domains, explained

6 domains and 24 official sub-domains. Forensic Science carries the most weight at 18%. Each guide explains what the domain covers, how its questions are framed and where candidates lose marks.

Start with Domain 1 See all domains
Questions
150 multiple-choice questions
Time
4 hours
Passing score
Not fixed: EC-Council sets a cut score per exam form, typically 60–85%
Outline
CHFI Exam Blueprint v3 (EC-Council, published 2024), used for CHFI v11 exam 312-49 (current)

Exam blueprint

Bar widths follow the official weights. Weight ranges are drawn at their midpoint.

  1. 1 18%
  2. 2 15%
  3. 3 17%
  4. 4 17%
  5. 5 17%
  6. 6 16%
  1. 1 Forensic Science
  2. 2 Regulations, Policies and Ethics
  3. 3 Digital Evidence
  4. 4 Procedures and Methodology
  5. 5 Digital Forensics
  6. 6 Tools/Systems/Programs

All 6 domains

24 official sub-domains 72–98 hrs suggested study

  1. Domain 01 18%

    Forensic Science

    The heaviest CHFI v11 domain at 18%. It covers cybercrime categories and investigation challenges, the role of the forensic investigator, the rules behind data acquisition, and how databases, cloud, email, IoT, malware and the dark web work before you investigate them.

    Inside this domain

    • Understand different types of cybercrimes and list various forensic investigations challenges
    • Understand the fundamentals of computer forensics and determine the roles and responsibilities of forensic investigators
    • Understand data acquisition concepts and rules
    • Understand the fundamental concepts and working of databases, cloud computing, Emails, IoT, Malware (file and fileless) and dark web

    Watch for Shut it down first

    Sub-domains
    4
    Questions est.
    ~27
    Study time est.
    12–16 hrs
  2. Domain 02 15%

    Regulations, Policies and Ethics

    Worth 15% of CHFI v11, this domain covers the legal side of an investigation: when evidence may be searched and seized, how chain of custody and the rules of evidence keep it admissible, and which laws and privacy obligations shape forensic work.

    Inside this domain

    • Understand rules and regulations pertaining to search & seizure of the evidence, and evidence examination
    • Understand different laws and legal issues that impact forensic investigations

    Watch for Warrant covers everything

    Sub-domains
    2
    Questions est.
    ~23
    Study time est.
    8–12 hrs
  3. Domain 03 17%

    Digital Evidence

    Digital Evidence is 17% of CHFI v11 and spans five sub-domains: what makes data evidence, how disks, file systems and operating systems store it, which logs record activity, how encoding and file signatures work, and how WAFs and MySQL keep records.

    Inside this domain

    • Understand the fundamental characteristics and types of digital evidence
    • Understand the fundamental concepts and working of desktop and mobile Operating Systems
    • Understand different types of logs and their importance in forensic investigations
    • Understand various encoding standards and analyze various file types
    • and 1 more sub-domains

    Watch for Trust the extension

    Sub-domains
    5
    Questions est.
    ~26
    Study time est.
    12–16 hrs
  4. Domain 04 17%

    Procedures and Methodology

    Procedures and Methodology is 17% of CHFI v11. It turns concepts into steps: the forensic investigation process from lab setup to testimony, how to acquire volatile and static data, how to examine images and correlate events, and how to approach Tor and malware cases.

    Inside this domain

    • Understand Forensic Investigation Process
    • Understand the methodology to acquire data from different types of evidence
    • Illustrate Image/Evidence Examination and Event Correlation
    • Explain Dark Web and Malware Forensics

    Watch for Analyze first

    Sub-domains
    4
    Questions est.
    ~25
    Study time est.
    12–16 hrs
  5. Domain 05 17%

    Digital Forensics

    Digital Forensics is 17% of CHFI v11 and has the most sub-domains, seven. It is the analysis domain: defeating anti-forensics, reading Windows, Linux and Android artifacts, investigating network and web attacks, handling database, cloud, email and IoT cases, and analyzing malware.

    Inside this domain

    • Review Various Anti-Forensic Techniques and Ways to Defeat Them
    • Analyze Various Files Associated with Windows and Linux and Android Devices
    • Analyze various logs and perform network forensics to investigate network attacks
    • Analyze Various Logs and Perform Web Application Forensics to Examine Various Web Based Attacks
    • and 3 more sub-domains

    Watch for Wiped means no case

    Sub-domains
    7
    Questions est.
    ~25
    Study time est.
    16–22 hrs
  6. Domain 06 16%

    Tools/Systems/Programs

    Tools/Systems/Programs is 16% of CHFI v11 in two sub-domains: choosing tools to investigate Windows, Linux, Mac, Android and iOS, and tools for MSSQL, MySQL, Azure, AWS, email and IoT evidence. The focus is matching each tool to its job.

    Inside this domain

    • Identify various tools to investigate Operating Systems including Windows, Linux, Mac, Android and iOS
    • Determine the various tools to investigate MSSQL, MySQL, Azure, AWS, Emails and IoT devices

    Watch for Volatility captures RAM

    Sub-domains
    2
    Questions est.
    ~24
    Study time est.
    12–16 hrs

Study the heaviest domains first

Marks follow weight. This order puts the most marks behind you first, across about 72–98 hrs of study.

  1. 1 Forensic Science 18% · 12–16 hrs
  2. 3 Digital Evidence 17% · 12–16 hrs
  3. 4 Procedures and Methodology 17% · 12–16 hrs
  4. 5 Digital Forensics 17% · 16–22 hrs
  5. 6 Tools/Systems/Programs 16% · 12–16 hrs
  6. 2 Regulations, Policies and Ethics 15% · 8–12 hrs

Try one

Practice questionDomain 1: Forensic Science

An investigator arrives at a logged-in workstation where an employee is suspected of leaking files. A BitLocker-encrypted data volume is currently mounted. The investigator has a write blocker and a memory capture tool. What should be done first?

One trap from every domain

The answer that looks right, and the clue that gives it away.

  • Domain 1

    Shut it down first

    Clue The system is described as running or logged in.

  • Domain 2

    Warrant covers everything

    Clue The discovered material is unrelated to the warrant's subject.

  • Domain 3

    Trust the extension

    Clue A hex header is shown in the question.

  • Domain 4

    Analyze first

    Clue No image or hash has been mentioned yet.

  • Domain 5

    Wiped means no case

    Clue The scenario mentions a cleanup or wiping utility.

  • Domain 6

    Volatility captures RAM

    Clue The task is to capture or dump memory.

Other Cybersecurity certifications

Study guides for exams that overlap with CHFI.

Practise what you read

CHFI domains: common questions

How many domains are in the CHFI exam?

CHFI has 6 domains with 24 official sub-domains between them: Forensic Science, Regulations, Policies and Ethics, Digital Evidence, Procedures and Methodology, Digital Forensics and Tools/Systems/Programs.

Which CHFI domain carries the most weight?

Forensic Science is the heaviest at 18%, followed by Digital Evidence (17%). The lightest is Regulations, Policies and Ethics (15%). Weights come from EC-Council's official outline.

What is the CHFI exam format?

Questions: 150 multiple-choice questions. Time allowed: 4 hours. Passing score: Not fixed: EC-Council sets a cut score per exam form, typically 60–85%.

How long should I study for CHFI?

Our planning estimate is 72–98 hrs across all domains, split by weight. It is an editorial estimate, not an official figure, so adjust it to your experience and to how you score on practice questions.

Where should I start?

Start with Forensic Science, because it carries the most marks, then work down by weight. Use the checklist on each domain page to confirm you can do what the domain asks before moving on.

Which outline is this guide based on?

This guide follows CHFI Exam Blueprint v3 (EC-Council, published 2024), used for CHFI v11 exam 312-49 (current), published by EC-Council. It was last reviewed in October 2026.

Domain names, weights and sub-domains come from EC-Council's official outline (CHFI Exam Blueprint v3 (EC-Council, published 2024), used for CHFI v11 exam 312-49 (current)). Question counts and study hours are editorial planning estimates, not official figures. Last reviewed October 2026.