Dariel, a forensic investigator, has been assigned to investigate a recent security incident that occurred...

According to the CHFI v11 curriculum underNetwork Forensics, investigators must be proficient in using packet sniffing tools to capture and analyze live network traffic.tcpdumpis a widely usedcommand-line packet analyzerthat runs natively on Unix, Linux, and BSD-based systems. It allows investigators to capture packets in real time, apply powerful filters, and save traffic inPCAP formatfor further offline analysis using tools such as Wireshark.

In forensic investigations, tcpdump is especially valuable because it provides low-level visibility into network communications, including source and destination IP addresses, ports, protocols, TCP flags, and payload data. This enables investigators to detect suspicious behaviors such as unauthorized connections, port scans, malware command-and-control traffic, data exfiltration attempts, and denial-of-service activities. CHFI v11 specifically highlightstcpdumpas a core tool fornetwork traffic investigation and evidence gatheringin Unix-based environments.

The other options are incorrect. Metashield Analyzer is used for file-based threat analysis, Timestomp is an anti-forensics tool used to manipulate file timestamps, and Billboard is not a recognized network forensic or packet sniffing tool.

The CHFI Exam Blueprint v4 emphasizes the importance ofreal-time packet capture toolsfor network investigations, makingtcpdumpthe correct, forensically sound, and exam-aligned answer