An investigator has been assigned to analyze network activity and user interactions on a corporate...

Option A. Sawmill is the best answer because the scenario specifically requires a tool for parsing large volumes of IIS logs , identifying suspicious patterns, and generating detailed reports to support timeline reconstruction. In CHFI-style web-server investigations, examiners are expected to use specialized log-analysis tools to process IIS and Apache logs efficiently rather than relying only on manual review.

Sawmill is well suited to this type of work because it is designed for log analysis and reporting across web-server environments. That makes it the most appropriate choice among the listed options. DSInternals PowerShell is more associated with Active Directory and internal Windows directory analysis, not IIS log parsing. Hunchly is more focused on web capture and investigation support, not enterprise IIS log analytics. Jalheon is not the strongest fit for the specific requirements described.

Because the question emphasizes efficient parsing , anomaly detection , and report generation for IIS logs, the most accurate CHFI-aligned answer is Sawmill . It best supports structured web log analysis during breach investigations.