During a forensic investigation into a suspected cyberattack, the investigator checks network logs that were...

This scenario aligns closely with CHFI v11 objectives underProcedures and Methodology, specificallypostmortem analysis and log-based forensic investigation. Postmortem analysis refers to the examination of collected system, application, and network logsafter an incident has occurred, with the goal of reconstructing events and determining the root cause of a security breach.

In this case, the investigator is reviewinghistorical network logs collected during the incident window, not monitoring live traffic. CHFI v11 emphasizes that postmortem analysis is essential for answering the core forensic questions:what happened, how it happened, when it happened, and who was responsible. By correlating timestamps, IP addresses, protocols, and event sequences across logs, investigators can identify attack vectors, trace the origin of the attack, and understand attacker behavior.

Option C is incorrect because real-time analysis applies to live monitoring during an active incident. Option A describes an illegal activity unrelated to forensics, and option D refers to an attack technique rather than an investigative method. Therefore, consistent with CHFI v11 forensic methodologies, the investigator is performing apostmortem analysis of system records, making optionBthe correct answer.