SecProve
ProfessionalVendor-neutralEC-Council· issued from US

CHFI

EC Council Computer Hacking Forensics Investigator

EC Council Computer Hacking Forensics Investigator

Official page at EC-Council↔ Compare with another cert
Exam fee
$950
Ongoing
$80/yr AMF · 40 CPE/yr
Study time
80–150 hrs
Delivery
Hybrid
Validity
3 yrs (renewal cycle)

› Quality score

22.0 / 40

Four-axis SecProve rubric, each 0–10. SecProve editorial assessment — each axis carries a written justification so you can push back on any single call without dismissing the whole score.

Blueprint rigor
How well-defined and rigorous the exam blueprint is.
EC-Council blueprint is broad but lacks the depth of GCFA or industry-led programs.
5.5/10
Practical evidence
Hands-on labs / written reports vs pure MCQ.
Includes practical-style items but most labs are sandboxed walkthroughs.
4.5/10
Currency & upkeep
How aggressively content is kept current with the field.
Updated to v11 in 2024 with cloud-forensics content.
6.0/10
Market recognition
How often this signal actually moves a hiring decision.
DoD 8570 / 8140 baseline keeps it on listings; less respected than GCFA among practitioners. [Holders: 20k, 2024-12] [DoD 8140 listed]
6.0/10

› Market signals

public, citable inputs to the recognition score
Holders worldwide
20,000
as of 2024-12 · source
DoD 8140 baseline
Listed
CSSP-Infrastructure

› Exam format

150 multiple-choice questions, 4 hours, proctored. Passing score: 70%.

Retake policy
Fee: $499 per attempt
Wait: 0d between attempts

First retake immediate; 14 days between attempts 2-3, 1 month between 3-4, 3 months between 4-5. Max 5 attempts/year.

› Recertification

Valid for 3 years. 120 ECE credits over 3 years + annual AMF (80 USD).

› 3-year cost of ownership

Exam (1×)
$950
AMF (3×)
$240@$80/yr
Total
$1190

Excludes study materials, training, retake risk, and lost-wage opportunity. Use as a floor estimate.

› NICE Framework work roles

The NIST NICE work-role IDs this cert maps to. NICCS lookup.

DD-WRL-009PD-WRL-004PD-WRL-002PD-WRL-003
Recognition
Global
Exam languages
en

› Core domains covered

The 2 domains this cert is centrally about. Passing the exam demonstrates working knowledge of each.

A7Incident Response & Forensics

IR playbooks, memory/disk/network forensics, chain of custody, malware analysis.

A21Malware Analysis & Reverse Engineering

Static/dynamic analysis, sandbox analysis, assembly/disassembly, packer analysis, YARA rules, malware family classification.

› Prerequisites

Experience

2 years IS experience OR official EC-Council training course.

› Progression

requiredrecommended

Where this cert fits in the typical learning path. Required edges are vendor-gated; recommended edges reflect de facto industry progression.

Required prereqs (0)

No vendor-gated prereqs.

Recommended priors (1)
CEHEC-Council
CHFI
EC-Council
Required by (0)

No certs require this one.

Recommended next (0)

No follow-on certs reference this one yet.

See this cert’s domains highlighted on the interactive map, or compare it against the rest of the catalog.

Highlight on the domain mapBrowse all certifications