Marine Corps COOL Snapshot - Computer Hacking Forensic Investigator (CHFI)

Computer Hacking Forensic Investigator (CHFI)

Renewal Period: 3 years

The Computer Hacking Forensic Investigator (CHFI) credential is for professionals in the field of defense and military personnel, e-Business security professionals, systems administrators, legal professionals, banking, insurance, IT managers, government agencies, and police and other law enforcement personnel. The CHFI certification will ensure that participants have the necessary skills to identify an intruder's footprints and to properly gather the necessary evidence to prosecute in the court of law. Candidates that do not attend official training must have a minimum of two years of work experience in the Information Security domain to be eligible to sit for the exam.

More information can be found on the certifying agency's website.

Computer Hacking Forensic Investigator (CHFI)

The following Marine Corps Enlisted MOSs provide training and/or experience that contributes to attaining this credential:

Enlisted Occupation	Occupation Type	Related As	COOL$
1711 Offensive Cyberspace Operator	MOS	Most	COOL Bucks
1721 Defensive Cyberspace Operator	MOS	Most	COOL Bucks
1799 Cyberspace Chief	MOS	Some	COOL Bucks
2611 Cryptologic Cyberspace Analyst	MOS	Other
2629 Signals Intelligence/ Electronic Warfare/Cyberspace Operations Technician	MOS	Other
2651 Intelligence Surveillance Reconnaissance (ISR) Systems Engineer	MOS	Other

The following civilian occupations are related to this credential:

	Civilian Job	Job Family	Bright Outlook	Registered Apprenticeship	Local Salary Info
	Information Security Analysts	Computer and Mathematical	Bright Outlook	Apprenticeship	find local salary

MINIMUM REQUIREMENTS

Attainability:

Eligibility Requirements (View Details)

Credential Prerequisite
Experience: 2 years
Education
Training
Membership
Other
Fee

Note: This credential may have multiple options for a Service member to meet eligibility requirements. Requirements listed here are based on the minimum degree required. To view other options, see the Eligibility tab.

Exam Requirements (View Details)

Exam
Written Exam
Oral Exam
Practical Exam
Performance Assessment

Exam Administration (View Details)

In-person exam
Remote proctored on-line exam
Third-party test vendor

RECERTIFICATION SUMMARY

Renewal Period: 3 years

Continuing Education
Exam
Continuing Education OR Exam
Fee
Other

AGENCY CONTACT INFORMATION

International Council of Electronic Commerce Consultants (EC-Council)

101C Sun Avenue NE
Albuquerque, NM 87109

Phone: 1-844-662-3509

Email: Johanna.pirolo@eccouncil.org

Show All / Hide All

Education/Training and/or Experience REQUIREMENTS

Option 1:

Candidates may attend an official CHFI instructor-led training (ILT), computer-based training (CBT), online live training, academic learning or have been certified in a previous version of the credential.

Option 2:

Candidates who do not attend official training must have at least 2 years of work experience in the Information Security domain and an educational background that reflects specialization in Information Security.

Other REQUIREMENTS

The Computer Hacking Forensic Investigator (CHFI) credential has the following other requirements:

Candidates who do not attend the Computer Hacking Forensic Investigator Course must submit an Exam Eligibility Application Form and obtain authorization from EC-Council before attempting the exam.

Prior to attempting the exam, candidates are required to AGREE to:
- EC-Council Non-Disclosure Agreement terms
- EC-Council Candidate Application Agreement terms
- EC-Council Candidate Certification Agreement terms

Written Exam CHFI Exam V2.1

Forensic Science (15%)
- Computer Forensics Objective and Need
- Forensics Readiness
- Cyber Crime
- Web Applications and Webservers Attacks
- Email Crimes
- Network Attacks
- Forensics on Mobile Devices
- Cyber Crime Investigation
- Computer Forensics Investigation Methodology
- Reporting a Cyber Crime
- Expert Witness
Regulations, Policies and Ethics (10%)
- Searching and Seizing Computers with and without a Warrant
- Laws and Acts against Email Crimes
- Laws pertaining to Log Management
- Policies Pertaining to Mobile Forensics
- Laws and Acts against Email Crimes
- General Ethics While Testifying
Digital Evidence (20%)
- Digital Evidence
- Types of Digital Evidence
- Rules of Evidence
- Electronic Evidence: Types and Collecting Potential Evidence
- Electronic Crime and Digital Evidence Consideration by Crime Category
- Computer Forensics Lab
- Understanding Hard Disks
- Disk Partitions and Boot Process
- Understanding File Systems
- Windows File Systems
- Linux File Systems
- Mac OS X File Systems
- RAID Storage System
- File Carving
- Image Files
- Analyze Logs
- Database Forensics
- Email Headers
- Analyzing Email headers
- Malware Analysis
- Mobile Operating Systems
Procedures and Methodology (20%)
- Investigating Computer Crime
- Computer Forensics Investigation Methodology
- Digital Evidence Examination Process
- Encryption
- First Responder
- First Response Basics
- Roles of First Responder
- Data Acquisition and Duplication
- Defeating Anti-forensics Techniques
- Log Management and Event Correlation
- Network Forensics (Intrusion Detection Systems (IDS))
- Computer Forensics Reports and Investigative Report Writing
Digital Forensics (25%)
- Recover Data
- File System Analysis
- Windows Forensics
- Linux Forensics
- MAC Forensics
- Recovering the Deleted Files and Partitions
- Steganography and Image File Forensics
- Steganalysis
- Application Password Crackers
- Investigating and Analyzing Logs
- Investigating Network Traffic
- Investigating Wireless Attacks
- Web Attack Investigation
- Investigating Email Crime and Violation
- Mobile Forensic Process
- Cloud Forensics
- Malware Forensics
- Defeating Anti-Forensic Techniques
Tools/Systems/ Programs (10%)
- First Responder Toolkit
- Windows Forensic Tools (Helix3 Pro, X-Ways Forensics, Windows Forensic Toolchest (WFT), Autopsy, The Sleuth Kit (TSK), etc.)
- Data Acquisition Software Tools UltraKit Forensic Falcon, etc.)
- Tools to defeat Anti-Forensics
- Steganography Tools
- Database Forensics Tools
- Password Cracking Tools
- Network Forensics Tools
- Web Security Tools, Firewalls, Log Viewers, and Web Attack Investigation Tools
- Cloud Forensics Tools
- Malware Forensics Tools
- Email Forensics Tools
- Mobile Forensics Software and Hardware Tools
- Report Writing Tools

Exam Preparation Resources

There are a number of resources available to help you prepare for the Computer Hacking Forensic Investigator (CHFI) examination:

Best Sources

Related Courses
- EC-Council Cybersecurity Course Library

An additional resource is O'Reilly Learning Safari Books Online, a searchable digital library that provides online access to thousands of books, training videos and conference sessions. See the Educational Resources section on the Related Sites page here on COOL to learn how to get free access.

Testing Information

Exam Administration
Credential exams may be administered in-person at a testing site, proctored on-line remotely, or have options for both. If an exam is administered through a test vendor, the third-party test vendor box will be checked. The following test administration options apply to the Computer Hacking Forensic Investigator (CHFI) credential where checked:
- In-person exam
- Remote proctored on-line exam
- Third-party test vendor

For more information on the International Council of Electronic Commerce Consultants (EC-Council) testing process, visit the agency website.

Third-Party Test Vendor Information
Testing for this credential is handled by Pearson VUE. The test centers are located in the U.S. They also have some test centers on military bases.

To find out more, use the following links on the Pearson VUE website:

RECERTIFICATION

Computer Hacking Forensic Investigator (CHFI)

Renewal Period: 3 years

The Computer Hacking Forensic Investigator (CHFI) credential has the following recertification information:

To renew the CHFI credential for another 3-year period, certificate holders need to update his or her EC-Council Continuing Education (ECE) credit account in the EC-Council Delta portal and submit proof of earned credits. To maintain certification, certificate holders must earn a total of 120 credits within 3 years of ECE cycle period.

The credits can be earned in many ways including attending conferences, writing research papers, preparing for training classes in a related domain (for instructors), reading materials on related subject matters, taking an exam of a newer version of the certification, attending webinars, and many others.

Note: Marine Corps COOL will only pay recertification fees for the current billing cycle. Voucher requests for recertification fees must be submitted with proof of the current status of the certification (for example, a screen shot of your credentialing agency dashboard or a copy of a current fee receipt).