The CHFI (Computer Hacking Forensic Investigator) certification from EC-Council is a globally recognized credential for digital forensics professionals. It validates your ability to investigate cybercrime, collect and preserve digital evidence, and present findings in a legally defensible manner. This free printable PDF gives you practice questions drawn from all major CHFI exam domains — from evidence acquisition and chain of custody to memory forensics and cloud investigations. Practice with the free CHFI - Computer Hacking Forensic Investigator practice test on PracticeTestGeeks (7 questions with answer explanations).
Use this PDF alongside our online CHFI practice test to test your knowledge in both offline and timed online environments before sitting the real exam.
Facts verified Nov 1, 2026 against EC-Council. Dates that have passed are removed automatically.
Facts verified Nov 1, 2026 against EC-Council. Dates that have passed are removed automatically.
| Item | Detail | Official source |
|---|---|---|
| Number of questions | 150 multiple-choice questions | EC-Council |
| Time limit | 4 hours | EC-Council |
| Passing score | 60%–85%, depending on exam form | EC-Council |
| Exam fee (eligibility application) | USD 100 non-refundable application fee | EC-Council |
| Exam fee (exam voucher) | USD 650 exam voucher | EC-Council |
| Validity | 3 years | EC-Council |
| Delivery | ECC Exam Centre or remote proctoring | EC-Council |
| Eligibility | Official training or 2 years InfoSec experience | EC-Council |
| Score release | Shortly after completing the exam | EC-Council |
Facts verified Nov 1, 2026 against EC-Council. Dates that have passed are removed automatically.
Interactive CHFI - Computer Hacking Forensic Investigator resources on PracticeTestGeeks, free to start:
The CHFI exam tests practical knowledge across the full digital forensics investigation lifecycle. Each domain demands both conceptual understanding and hands-on tool familiarity — examiners expect you to recognize correct procedures for real-world scenarios.
The investigation process begins at the first response: securing the scene, documenting the environment, and establishing chain of custody before touching any device. You must know the order of volatility — CPU registers and cache first, then RAM, swap space, network state, running processes, disk, and finally optical/tape media. Evidence seizure procedures differ for powered-on vs. powered-off systems.
Disk imaging is core to the exam. Know FTK Imager and the dd command syntax, why write blockers are mandatory, and how hash verification (MD5 and SHA-256) proves image integrity. For live systems, RAM acquisition tools — Magnet RAM Capture, WinPmem — capture volatile data including running processes, open network connections, and encryption keys. Mobile acquisition modes range from logical (file system exports) to chip-off (physical NAND extraction).
NTFS internals are heavily tested: the Master File Table (MFT), $LogFile (transaction log), $UsnJrnl (change journal), file slack space, and unallocated cluster recovery. Know MAC times — Modified, Accessed, Created — and how NTFS timestamps differ from FAT32. Linux ext2/ext3/ext4 forensics include inode structure and journal analysis.
The Windows registry is a goldmine of forensic artifacts. Key hives: HKLM (system-wide settings) and HKCU (user-specific). High-value keys include recently accessed files, USB device history (SYSTEM hive), and user account information. Windows Event Logs (Security, System, Application) provide login events, account changes, and service activity. Prefetch files, LNK (shortcut) files, and Recycle Bin ($I and $R files) reveal program execution and deleted file history.
Wireshark packet capture analysis includes reading IP header fields (TTL, protocol, source/destination), reassembling TCP streams, and identifying protocol anomalies. IDS/IPS, firewall, and router logs require interpretation. Email header analysis — tracing X-Originating-IP, Received headers — is a common scenario question. VoIP forensics covers SIP and RTP stream analysis.
Examiners test your ability to detect anti-forensics: file signature analysis catches renamed extensions, steganography detection tools identify hidden data in images, and timestamp manipulation leaves artifacts in $UsnJrnl. Know disk wiping patterns (DoD 5220.22-M standard, Gutmann method) and what remnants survive after each method.
Memory forensics covers process list analysis, network connection artifacts, and malware indicators in RAM dumps. Cloud forensics challenges — jurisdiction ambiguity, data co-mingling, multi-tenancy — and how to obtain cloud provider logs and issue legal holds in cloud environments are increasingly common exam topics.
The downloadable PDF is ideal for offline review, but our interactive online CHFI practice test delivers immediate scoring, per-question explanations, and domain-level performance breakdowns. Use both formats together to build the speed and accuracy the 4-hour, 150-question CHFI exam demands.
Try these questions from our free CHFI - Computer Hacking Forensic Investigator practice tests. The correct answer and an explanation follow each question.
A forensic investigator is analyzing a hard drive from a suspect's computer and finds a small file. The file's logical size is 300 bytes. The file system uses a cluster size of 4096 bytes and a sector size of 512 bytes. The investigator wants to examine the area from the end of the 300-byte file to the end of the first sector. What is this specific area known as?
Answer: D. RAM Slack
RAM Slack is the space from the end of a file to the end of the sector it occupies. In this scenario, the file ends at byte 300, and the sector ends at byte 512. The 212 bytes in between constitute the RAM slack. This area is often filled with random data from the computer's memory at the time the file was written. Drive slack would be the remaining sectors in the cluster.
A forensic investigator is examining a 4 TB hard drive from a modern Windows 11 system. The investigator needs to understand the partitioning scheme to locate potential hidden partitions. Which partitioning scheme would the investigator most likely encounter, and what is its primary advantage over the older standard?
Answer: B. GUID Partition Table (GPT), because it supports disks larger than 2 TB and allows for up to 128 primary partitions.
Modern systems with hard drives larger than 2 TB use the GUID Partition Table (GPT) scheme. MBR has a limitation of 2 TB and only supports up to four primary partitions. Ext4 is a file system, not a partitioning scheme, primarily used in Linux. FAT32 is an older file system with significant file and volume size limitations.
Computer forensic investigator Carlo is. He was given an assignment by a company to look into a forensic case. The computer at the crime site was turned off when Carlo arrived at the company to investigate the location. What do you think Carlo ought to do in this situation?
Answer: A. He should leave the computer off
When a computer at a crime scene is found turned off, the best practice for a forensic investigator is to leave it off. Turning it on would alter the system's state, potentially overwriting volatile data in RAM and modifying timestamps or log files, thus compromising the integrity of potential evidence. The correct procedure is to transport the device to a forensic lab for a controlled examination, where a forensically sound acquisition can be performed without altering the original state.
When an investigator testifies in court about forensic findings, what role does the investigator serve?
Answer: B. Expert witness
A forensic investigator testifies as an expert witness, allowed to provide opinions and interpretations based on specialized knowledge.
Take the full CHFI - Computer Hacking Forensic Investigator practice test