Computer Hacking Forensic Investigator (CHFI) V11 Practice Test

Analyzing log files from applications and web servers is the most effective way to determine where an attack came from, what the attacker did, and when it happened. Logs capture timestamps, source IPs, requested resources, response codes, user agents, and error messages. By examining these records, you can identify the origin (the source IP or proxy), the nature of the attack (for example, repeated login failures, unusual URLs, SQL injection patterns, or scripted probes), and the sequence of events (using timestamps to build a timeline). Correlating entries across web and application logs, and across different systems like firewalls, strengthens attribution and timing. Ensuring synchronized clocks and preserving log integrity are important for credible reconstruction. Other data types don’t provide the same forensic value for this task: the SAM file contains user account information and security metadata, not attack activity; rainbow tables are used for password cracking rather than documenting events; boot records relate to the system’s startup sequence and don’t reflect ongoing network activity.