CHFIv8 (312-49) exam/course review
I recently passed the CHFIv8 exam, and thought I'd share my learning experience with those who may be looking to do the same.
Currently, I'm enrolled in WGU's MS:ISA program, and the CHFI is part of the currciculum. I have no specific background in forensics other than an introduction to Criminology class I took in college 15+ years ago. However, I have taken other EC-Council exams, so I knew what to expect to a certain degree.
Learning Materials:
Official EC-Council CHFI text
Officical EC-Council iLabs, and iClass
uCertify
The official EC-Council CHFI text provided appeared to be out of date, and likely mapped to the CHFIv7 learning obectives. I read a couple of chapters, after which, I found that the video from the iClass just didn't match up with what was presented in the text. For the purposes of passing the exam, I found little value in the material, and after reading a couple chapters, I skipped the rest.
The iClass material, I thought was very informative, the presenter didn't just read the slides like the presenter did for the CEHv7 material. You could tell that the presenter had real world experience in the field of forensics, and although he could be a little windy, at times, I thought the videos and the presenter were top notch.
It's worth noting that the video is streamed in high quality, mp4 video. My 1.54MB connection sputtered and buffered on multiple occassions, so much so that you might consider using Flashgot, or similar utility to download the video, and watch the vidoes offline, if you have less than a 4MB connection.
The iLABS material was also worthwhile. In the CEHv7 iLAB format, it was pain having to read the PDF and then switch screens to the virtual machine, and then perform the required actions. In the current iLABS format, the lab requirements are presented in steps, in a panel, at the bottom of the virtual machine. This feature made it a lot easier to perform the labs without having to switch back and forth between the instructional lab PDFs and virtual machine.
uCertify was worthwhile in that it more or less put everything that was presented in the videos into textual format. The chapters were worth reading, and reinforced the material presented in the vidoes.
The practice uCertify quizes, and exercises, however, were spotty at best. In some instances, the questions appeared to be from another course, entirely. The quizes/exercises that were correct, reflected what was in the text chapters, however, I found them to be overfly detailed and specific. For example, the application might quiz you on what specific tool of the 30 or so tools listed in the text, opened a .GIF, .BMP, and .JPG files, but didn't open .TIFF files, and then present you with a choice of 4 picture viewer applications. If you can memorize the text for 20 or so chapters to that level of detail, then you should have no problem answering the uCertify questions or passing the actual exam for that matter.
Unlike the CEH, legitimate 3rd party CHFI material was hard to come by. I did see that Amazon had an All-in-one book available for pre-order, but at the time of this writing, it has yet to be published. I also checked Boson for practice tests, which I've had success with in the past, but no practice tests for the CHFI were available.
The exam itself was simple compared to the types of questions and level of detail that that uCertify quizes queried. There were several true and false questions that were dead giveaways, that anyone could likely guess correctly without any prior computer forensic knowledge. Also there were a number of mutiple choice questions with obvious answers that anyone who skimmed over the material could answer. There also seemed to be some disparity among the questions asked, and the material covered. For example, attack types seemed to be heavily emphasized, while other questions reagarding specific forensic tools which had whole vidoes and chapters devoted to them were entirely ignored. At one point, I began to wonder if I was taking the right version of the test. I agree in what others have said in that it almost appears like they took a random sampling of the CEH test bank, and threw it into the CHFI exam.
All that said, I passed, with 3 hours and 15 minutes to spare with a score in the 90's. If they could just get the exam "right" I think they might actually have a decent program on their hands.
Currently, I'm enrolled in WGU's MS:ISA program, and the CHFI is part of the currciculum. I have no specific background in forensics other than an introduction to Criminology class I took in college 15+ years ago. However, I have taken other EC-Council exams, so I knew what to expect to a certain degree.
Learning Materials:
Official EC-Council CHFI text
Officical EC-Council iLabs, and iClass
uCertify
The official EC-Council CHFI text provided appeared to be out of date, and likely mapped to the CHFIv7 learning obectives. I read a couple of chapters, after which, I found that the video from the iClass just didn't match up with what was presented in the text. For the purposes of passing the exam, I found little value in the material, and after reading a couple chapters, I skipped the rest.
The iClass material, I thought was very informative, the presenter didn't just read the slides like the presenter did for the CEHv7 material. You could tell that the presenter had real world experience in the field of forensics, and although he could be a little windy, at times, I thought the videos and the presenter were top notch.
It's worth noting that the video is streamed in high quality, mp4 video. My 1.54MB connection sputtered and buffered on multiple occassions, so much so that you might consider using Flashgot, or similar utility to download the video, and watch the vidoes offline, if you have less than a 4MB connection.
The iLABS material was also worthwhile. In the CEHv7 iLAB format, it was pain having to read the PDF and then switch screens to the virtual machine, and then perform the required actions. In the current iLABS format, the lab requirements are presented in steps, in a panel, at the bottom of the virtual machine. This feature made it a lot easier to perform the labs without having to switch back and forth between the instructional lab PDFs and virtual machine.
uCertify was worthwhile in that it more or less put everything that was presented in the videos into textual format. The chapters were worth reading, and reinforced the material presented in the vidoes.
The practice uCertify quizes, and exercises, however, were spotty at best. In some instances, the questions appeared to be from another course, entirely. The quizes/exercises that were correct, reflected what was in the text chapters, however, I found them to be overfly detailed and specific. For example, the application might quiz you on what specific tool of the 30 or so tools listed in the text, opened a .GIF, .BMP, and .JPG files, but didn't open .TIFF files, and then present you with a choice of 4 picture viewer applications. If you can memorize the text for 20 or so chapters to that level of detail, then you should have no problem answering the uCertify questions or passing the actual exam for that matter.
Unlike the CEH, legitimate 3rd party CHFI material was hard to come by. I did see that Amazon had an All-in-one book available for pre-order, but at the time of this writing, it has yet to be published. I also checked Boson for practice tests, which I've had success with in the past, but no practice tests for the CHFI were available.
The exam itself was simple compared to the types of questions and level of detail that that uCertify quizes queried. There were several true and false questions that were dead giveaways, that anyone could likely guess correctly without any prior computer forensic knowledge. Also there were a number of mutiple choice questions with obvious answers that anyone who skimmed over the material could answer. There also seemed to be some disparity among the questions asked, and the material covered. For example, attack types seemed to be heavily emphasized, while other questions reagarding specific forensic tools which had whole vidoes and chapters devoted to them were entirely ignored. At one point, I began to wonder if I was taking the right version of the test. I agree in what others have said in that it almost appears like they took a random sampling of the CEH test bank, and threw it into the CHFI exam.
All that said, I passed, with 3 hours and 15 minutes to spare with a score in the 90's. If they could just get the exam "right" I think they might actually have a decent program on their hands.
