This scenario aligns closely with CHFI v11 objectives under Procedures and Methodology , specifically postmortem analysis and log-based forensic investigation . Postmortem analysis refers to the examination of collected system, application, and network logs after an incident has occurred , with the goal of reconstructing events and determining the root cause of a security breach.
In this case, the investigator is reviewing historical network logs collected during the incident window , not monitoring live traffic. CHFI v11 emphasizes that postmortem analysis is essential for answering the core forensic questions: what happened, how it happened, when it happened, and who was responsible . By correlating timestamps, IP addresses, protocols, and event sequences across logs, investigators can identify attack vectors, trace the origin of the attack, and understand attacker behavior.
Option C is incorrect because real-time analysis applies to live monitoring during an active incident. Option A describes an illegal activity unrelated to forensics, and option D refers to an attack technique rather than an investigative method. Therefore, consistent with CHFI v11 forensic methodologies, the investigator is performing a postmortem analysis of system records , making option B the correct answer.