10%

of attacks were resolved within the first hour, though many could have been. EC-Council C|EH Threat Report 2024.

Computer Hacking Forensic Investigator (CHFI v11) certification

Every Breach Leaves Evidence.

Most attacks drag on long after they start. CHFI teaches you to trace what happened, preserve the evidence and build a case that holds up.

HRD Corp claimableYayasan Peneraju: may be eligibleKL, Penang or online

Exam

312-49

Course

5 days

Course fee

RM6,200

Exam fee

Included

Next intake

16 Nov 2026

Quick answer

What is CHFI?

Computer Hacking Forensic Investigator (CHFI) is EC-Council’s digital forensics certification. It proves you can investigate a cyber incident: acquire and preserve evidence, analyse systems, networks, cloud and mobile devices, and report findings that stand up to scrutiny. One 4-hour, 150-question exam (312-49) earns it.

Exam facts verified against eccouncil.org on 23 Oct 2026

FOR

Incident responders, security analysts, law enforcement and legal teams

ROLES

Digital forensics investigator, incident response analyst, forensics examiner

SKIP IF

Security basics are new to you. Start with ECSS or Security+

01

The Credential

What you study, practise and sit to earn it.

Pass one exam, 312-49, and you hold CHFI. It shows employers you can take an incident from first alert to a defensible report, the work that decides what happened and who is responsible.

COURSE

5 days, 15 modules

HANDS-ON

68 forensic labs, 600+ tools

EXAM

312-49, 4 hrs

CREDENTIAL

EC-Council CHFI

Awarded by

EC-Council

Version

v11

Level

Intermediate

Evidence files

70+ GB of crafted evidence

Lab access

Six months of official labs

Renewal

120 ECE credits over 3 years

02

Decide in 60 Seconds

Four options people weigh against each other.

If you want to

Choose

Why

Investigate incidents and build the evidence trail

→

CHFI

Forensic process across systems, networks, cloud and mobile

Break in the way attackers do

→

CEH v13

Offensive techniques with 221 labs

Detect and respond as a SOC analyst

→

CompTIA CySA+

Vendor-neutral detection, vulnerabilities and response

Try hacking, defence and forensics as a beginner

→

ECSS

One entry-level exam across three disciplines

Basic IT and security knowledge assumed. Are you ready?
0/4

Tick what applies. 3 or 4: you are ready for this course. Fewer: start with ECSS or CompTIA Security+.

03

What the Exam Covers

One exam, 150 questions across the full investigation.

150 questions in 4 hoursCut score: 60% to 85% by form

Process

Investigate

  • Forensic investigation process and readiness
  • Chain of custody and evidence handling
  • Defeating anti-forensics techniques

Evidence

Acquire and Analyse

  • Hard disks, file systems and data acquisition
  • Windows, Linux and Mac artefacts
  • RAM, network and malware analysis

Environments

Follow the Trail

  • Web attacks and the dark web
  • Cloud: AWS, Azure and Google Cloud
  • Email, social media, mobile and IoT

Source: EC-Council CHFI programme and exam pages. EC-Council’s exam blueprint is currently being updated.

04

What the Course Covers

15 modules in five themes, plus 68 hands-on forensic labs.

Five days of EC-Council’s official CHFI v11 course. You learn the investigation process first, then apply it to every place evidence hides, from hard disks to the cloud.

3 modules

Investigation Foundations

  • Scope of Computer Forensics and Types of Cybercrime
  • Computer Forensics Investigation Process
  • Defeating Anti-Forensics Techniques

2 modules

Evidence and Acquisition

  • Understanding Hard Disks and File Systems
  • Data Acquisition and Duplication

2 modules

Operating Systems

  • Windows Forensics
  • Linux and Mac Forensics

4 modules

Networks, Malware and the Web

  • Network Forensics
  • Malware Forensics
  • Investigating Web Attacks
  • Dark Web Forensics

4 modules

Cloud, Mobile and IoT

  • Cloud Forensics
  • Email and Social Media Forensics
  • Mobile Forensics
  • IoT Forensics

68

hands-on forensic labs with more than 600 tools and 70+ GB of crafted evidence files, from RAM capture to cloud investigations.

05

Why Now

How slowly attacks are contained, what is hitting Malaysia, and why train with us.

10%

of attacks were resolved within the first hour, though many could have been

EC-Council C|EH Threat Report 2024

82%

of professionals say regular training is pivotal to incident response

EC-Council C|EH Threat Report 2024

16%

rise in cyber incidents reported to MyCERT in Q1 2026, to 2,188 cases

MyCERT Cyber Incident Summary Report, Q1 2026

6 hrs

Six Hours to Report. Who’s Watching the Alerts?

Malaysia’s Cyber Security Act 2024 (Act 854) came into force on 26 August 2024. Critical infrastructure entities must report a cyber security incident within six hours, and managed SOC monitoring services now need a licence. Reporting fast, and accurately, depends on people who can investigate what happened.

NACSA; Cyber Security (Notification of Cyber Security Incident) Regulations 2024

EC-Council Accredited Training Center

Delivering EC-Council’s official CHFI v11 course

Exam included

One fee covers training and your exam

HRD Corp registered

This course is HRD Corp claimable

KL, Penang or online

Instructor-led in class or live online

06

The Cost, All In

Every figure per person, in ringgit.

Fees

Five-day course with 68 labsIncluded

CHFI exam (312-49)Included

Funding

HRD Corp claim for employersClaimable

Yayasan Peneraju financing (Bumiputera)May be eligible

Course with exam

RM6,200

Dates

Where

Fee

Mon 16 to Fri 20 Nov 2026

Kuala Lumpur or online

RM6,200 incl. exam

Mon 4 to Fri 8 Jan 2027

Kuala Lumpur or online

RM6,200 incl. exam

Mon 5 to Fri 9 Apr 2027

Kuala Lumpur, Penang or online

RM6,200 incl. exam

Mon 12 to Fri 16 Jul 2027

Kuala Lumpur or online

RM6,200 incl. exam

Training a team? We run private intakes on dates that suit your organisation, with HRD Corp claims handled alongside you.

07

Exam and Renewal

What exam day looks like, and what happens after you pass.

Certification

Computer Hacking Forensic Investigator (CHFI)

Exam code

312-49

Questions

150 multiple choice

Duration

4 hours

Passing score

60% to 85%, depending on the exam form

Delivery

EC-Council Exam Portal

Course version

v11

Exam fee

Included in the course fee

KEEP IT ACTIVE

Earn 120 ECE credits

Collect 120 EC-Council Continuing Education credits within each three-year cycle through training, events and other learning.

ANNUAL FEE

US$80 a year

EC-Council charges an annual continuing education fee of US$80 for members holding at least one certification under its ECE policy.

FAQ

Questions People Ask

What is CHFI?

Computer Hacking Forensic Investigator (CHFI) is EC-Council’s digital forensics certification. It covers the full investigation, from acquiring and preserving evidence to analysing systems, networks, cloud and mobile devices and reporting the findings.

Trainocate teaches CHFI v11, EC-Council’s current programme, with 15 modules and 68 hands-on labs. It covers cloud forensics on AWS, Azure and Google Cloud, dark web and IoT forensics, and Python scripting for investigations.

At Trainocate Malaysia the five-day CHFI course is RM6,200 per person, including the exam. The course is HRD Corp claimable, and Malaysian Bumiputera learners may be eligible for Yayasan Peneraju funding.

Exam 312-49 has 150 multiple-choice questions in four hours, taken through the EC-Council Exam Portal. The cut score ranges from 60% to 85% depending on the exam form.

IT and security professionals in incident response or forensics, plus law enforcement, defence, legal, banking and government staff who handle investigations or digital evidence.

CEH teaches you to attack systems the way a hacker would. CHFI teaches you to investigate after an attack and build the evidence trail. Many professionals take CEH first, then CHFI.

Earn 120 EC-Council Continuing Education credits every three years and pay the annual US$80 continuing education fee.

Follow the Evidence

Pick an intake. An advisor confirms fees, HRD Corp claims and Yayasan Peneraju eligibility with you.

  • Next intake: 16 to 20 Nov 2026
  • RM6,200, exam included

Sources

  1. EC-Council: Computer Hacking Forensic Investigator (CHFI)
  2. EC-Council certification: CHFI exam information
  3. EC-Council: ECE policy
  4. EC-Council: C|EH Threat Report 2024 press release
  5. Trainocate: CHFI course page
  6. CyberSecurity Malaysia: Q1 2026 Cyber Incident Summary Report
  7. NACSA: Cyber Security Act 2024 (Act 854)
  8. MAICSA: Act 854 regulations summary