Overview
Domain 5 applies the methods from Domain 4 to real environments. It opens with anti-forensics, such as data wiping, steganography, timestamp tampering, alternate data streams, encryption and program packing, and how investigators detect or work around each one. It then moves to operating system artifacts on Windows, Linux and Android, for example prefetch, shellbags, jump lists, bash history and Android app databases.
The network sub-domain covers firewall, IDS, honeypot, router and DHCP logs, packet capture analysis and wireless attacks. The web sub-domain covers investigating attacks such as SQL injection, cross-site scripting, directory traversal and command injection from server and WAF logs. A broad sub-domain covers forensics on MSSQL and MySQL databases, dark web use, email headers, AWS and Azure cloud logs, and IoT devices. The last two sub-domains cover malware: static and dynamic analysis in a sandbox, then behavior at system and network level, including fileless techniques using PowerShell and WMI.
How it's tested
Questions here are interpretive. You will see a log excerpt, an email header, a URL, a registry path or a behavior description and must identify the attack, artifact or next analysis step. Expect a wide spread of environments, with only a few questions on each, so recognition across many artifact types matters most.
-
Identify the attack from evidence
A web or network log entry is shown and you name the attack, such as SQL injection, directory traversal or ARP poisoning.
-
Find the artifact
An activity on Windows, Linux, Android or a cloud service is described and you choose the artifact or log that proves it.
-
Beat the anti-forensic technique
A concealment method is described and you choose the detection or recovery approach.
An Apache access log shows a request for /download.php?file=../../../../etc/passwd returning status 200. The question asks what happened. The repeated ../ sequences step out of the web root, and /etc/passwd is a classic target, so this is directory traversal. The 200 response suggests the file was served, so the attack likely succeeded and the server needs further review.
Sub-domains 7
Official sub-domains from the EC-Council outline, in outline order.
5.1 Review Various Anti-Forensic Techniques and Ways to Defeat ThemConcealment methods attackers use and the countermeasures investigators apply.
- What it means
- Anti-forensics covers techniques that hide, destroy or falsify evidence: secure deletion and wiping, overwriting metadata, timestomping, hiding data in slack space or NTFS alternate data streams, steganography, encryption, password protection, program packers, artifact wiping tools and trail obfuscation. This sub-domain pairs each with methods to detect or defeat it.
- What to understand
- Wiping tools often leave their own traces, such as prefetch entries or registry records of execution. Timestomping can be detected by comparing $STANDARD_INFORMATION and $FILE_NAME timestamps in the MFT, since common tools change only the first. Alternate data streams can be listed with dir /r or forensic suites. Steganalysis looks for statistical anomalies or file size inconsistencies. Packed executables show high entropy and few readable strings. Encryption may be bypassed by capturing keys from live memory.
- How it shows up
- Expect to match an anti-forensic technique to its detection method or name the technique from its symptoms.
- Common confusion
- Assuming wiped data means no evidence; the wiping activity itself is often provable.
5.2 Analyze Various Files Associated with Windows and Linux and Android DevicesOperating system artifacts that show execution, access and user activity.
- What it means
- This sub-domain covers artifacts that reveal what happened on a device. On Windows: prefetch, shellbags, LNK files, jump lists, the Recycle Bin, thumbcache, event logs and browser data. On Linux: bash history, /var/log contents, cron jobs and user home directories. On Android: app SQLite databases, the data partition layout, and logs retrieved through ADB or physical extraction.
- What to understand
- Prefetch files show that a program ran and when, even if it was later deleted. LNK files and jump lists record files opened, including from removable or network drives. Shellbags show folders a user browsed. On Linux, .bash_history may be cleared or disabled, so its absence is itself worth noting. Android apps store messages and activity in SQLite databases under /data/data, which normally requires root-level or physical acquisition to reach.
- How it shows up
- Questions ask which artifact proves execution, file access or folder browsing on a given OS.
- Common confusion
- Using LNK files to prove a program ran; prefetch is the stronger execution artifact.
5.3 Analyze various logs and perform network forensics to investigate network attacksNetwork device logs, packet analysis, attack identification and wireless forensics.
- What it means
- Network forensics captures and analyzes traffic and device logs to investigate attacks. This sub-domain covers firewall, IDS, honeypot, router and DHCP logs, packet capture analysis with tools such as Wireshark, and identifying attacks such as port scans, DoS and DDoS, ARP poisoning, DNS poisoning and man-in-the-middle. It also covers wireless network attacks and evidence.
- What to understand
- DHCP logs map an IP address to a MAC address at a given time, which is how a dynamic address is tied to a device. Firewall and IDS logs show blocked and alerted traffic but may miss allowed malicious sessions. A SYN scan appears as many SYN packets to different ports with few completed handshakes. ARP poisoning shows one MAC address claiming several IPs. Full packet capture holds content, while flow records only summarize who talked to whom.
- How it shows up
- Expect to identify an attack from log or packet evidence, or pick the log that links an IP to a device.
- Common confusion
- Treating a source IP in a log as proof of who attacked; it may be spoofed, NATed or dynamic.
5.4 Analyze Various Logs and Perform Web Application Forensics to Examine Various Web Based AttacksInvestigating web attacks from server, application and WAF logs.
- What it means
- This sub-domain covers web application forensics: reconstructing attacks such as SQL injection, cross-site scripting, cross-site request forgery, directory traversal, command injection, file inclusion and brute-force logins from IIS and Apache logs, application logs and WAF records, and identifying web shells and defacement.
- What to understand
- Attack signatures appear in URLs and parameters: quote characters with OR 1=1 or UNION SELECT for SQL injection, script tags or encoded equivalents for XSS, ../ sequences for traversal, and shell metacharacters such as ; or | for command injection. URL encoding often disguises them, so decode before judging. The HTTP status code helps estimate success, though a 200 does not prove data was exposed. Web shells show up as unusual script files and repeated POST requests to a single page.
- How it shows up
- Questions show a log entry or URL and ask which attack it shows or whether it likely succeeded.
- Common confusion
- Missing an attack because it is URL-encoded, such as %27 for a single quote.
5.5 Perform Forensics on Databases, Dark Web, Emails, Cloud and IoT devicesInvestigation steps for MSSQL and MySQL, Tor use, email, AWS and Azure, and IoT.
- What it means
- This sub-domain applies forensic methods to specialized environments: MSSQL and MySQL database evidence, dark web activity on suspect devices, email investigations through header analysis, cloud investigations in AWS and Azure, and IoT device forensics across device, gateway and cloud components.
- What to understand
- In MSSQL, evidence sits in data and transaction log files and in plan cache and server state views. Email header analysis reads Received lines from bottom to top to trace the path and checks SPF, DKIM and DMARC results for spoofing. AWS evidence comes from CloudTrail for API calls and VPC Flow Logs for traffic; Azure uses Activity Logs and Microsoft Entra ID sign-in logs. IoT evidence is spread across the device, its companion app and the vendor cloud.
- How it shows up
- Expect to pick the cloud log for an activity, trace an email origin, or identify a database evidence source.
- Common confusion
- Reading email Received headers top to bottom; the earliest hop is at the bottom.
5.6 Perform Static and Dynamic Malware Analysis in a Sandboxed EnvironmentExamining malware without running it, then observing it in an isolated sandbox.
- What it means
- Static analysis inspects a sample without executing it: hashing, checking reputation, extracting strings, reviewing PE headers, sections, imports and resources, and detecting packing or obfuscation. Dynamic analysis runs the sample in a sandbox and monitors processes, file system and registry changes, network traffic and API calls. This sub-domain covers both approaches and how they complement each other.
- What to understand
- Static analysis is safe and fast but can be defeated by packing and encryption. Imported functions hint at capability, such as networking or keylogging APIs. Dynamic analysis reveals real behavior but malware may detect the sandbox and stay dormant. Baseline snapshots before and after execution make changes easy to compare. Analysts typically start static, then move to dynamic, and revisit static analysis once the sample unpacks itself in memory.
- How it shows up
- Questions ask which technique fits a goal or what a static indicator such as high entropy suggests.
- Common confusion
- Assuming dynamic analysis always reveals behavior; sandbox-aware malware may stay inactive.
5.7 Analyze Malware Behavior on System and Network Level, and Analyze Fileless MalwarePersistence, process and network behavior of malware, and fileless techniques.
- What it means
- This sub-domain covers how malware behaves once running: persistence through run keys, services, scheduled tasks and startup folders; process injection and hollowing; file and registry changes; and network behavior such as command-and-control beacons and data exfiltration. It also covers analyzing fileless malware that runs through PowerShell, WMI, macros and living-off-the-land binaries.
- What to understand
- System-level analysis compares system state before and after infection to find new autoruns, services and dropped files. Network-level analysis looks for periodic beacons, unusual DNS queries and connections to rare hosts. Fileless attacks often launch encoded PowerShell commands, so PowerShell script block logging and event ID 4104 become key evidence, along with WMI event subscriptions and memory captures. Living-off-the-land binaries such as certutil or mshta are trusted tools misused to download or run code.
- How it shows up
- Expect questions on persistence locations, beaconing indicators and where fileless malware evidence is found.
- Common confusion
- Treating a signed Microsoft binary as harmless; living-off-the-land attacks rely on exactly that assumption.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
Timestomping
Altering file timestamps to mislead a timeline.
- Remember
- Compare MFT $STANDARD_INFORMATION and $FILE_NAME times to detect it.
- Tested as
- Anti-forensics questions.
- Trap
- Trusting Explorer timestamps.
-
Alternate data streams
Hidden NTFS streams attached to a file.
- Remember
- List them with dir /r or forensic tools.
- Tested as
- Data hiding questions.
- Trap
- Assuming file size shows all content.
-
Steganography
Hiding data inside images, audio or other carriers.
- Remember
- Steganalysis looks for statistical or size anomalies.
- Tested as
- Concealment questions.
- Trap
- Confusing it with encryption.
-
Prefetch
Windows files recording program execution.
- Remember
- Shows run count and last run times even after deletion.
- Tested as
- Execution evidence questions.
- Trap
- Expecting prefetch on servers where it may be disabled.
-
Shellbags and LNK files
Artifacts of folder browsing and file access.
- Remember
- LNK files survive deletion of the target file.
- Tested as
- User activity questions.
- Trap
- Using them as execution proof.
-
DHCP logs
Records of IP address leases to MAC addresses.
- Remember
- They tie a dynamic IP to a device at a point in time.
- Tested as
- Attribution questions.
- Trap
- Ignoring lease time windows.
-
ARP poisoning
Sending forged ARP replies to redirect traffic.
- Remember
- One MAC mapped to multiple IPs is the clue.
- Tested as
- Network attack questions.
- Trap
- Confusing it with DNS poisoning.
-
SQL injection indicators
Quotes, OR 1=1, UNION SELECT and comment markers in parameters.
- Remember
- Decode URL encoding before judging.
- Tested as
- Web log questions.
- Trap
- Missing encoded payloads.
-
Directory traversal
Using ../ sequences to read files outside the web root.
- Remember
- Targets like /etc/passwd or win.ini are common.
- Tested as
- Web attack identification.
- Trap
- Calling it file inclusion.
-
Email header analysis
Tracing an email's path through Received headers.
- Remember
- Read from bottom to top; check SPF, DKIM and DMARC.
- Tested as
- Email forensics questions.
- Trap
- Trusting the From field.
-
AWS CloudTrail and Azure Activity Log
Cloud audit logs of management API calls.
- Remember
- VPC Flow Logs and NSG flow logs cover network traffic.
- Tested as
- Cloud forensics questions.
- Trap
- Looking for traffic data in CloudTrail.
-
Static vs. dynamic analysis
Inspect without running versus observe while running in a sandbox.
- Remember
- Use both; each catches what the other misses.
- Tested as
- Malware method questions.
- Trap
- Running samples outside isolation.
-
Persistence mechanisms
Run keys, services, scheduled tasks, startup folders, WMI subscriptions.
- Remember
- Check all autostart locations, not just Run keys.
- Tested as
- Malware behavior questions.
- Trap
- Stopping at the first autorun found.
-
PowerShell script block logging
Event ID 4104 records PowerShell code blocks as executed.
- Remember
- Key evidence for fileless attacks.
- Tested as
- Fileless malware questions.
- Trap
- Assuming fileless attacks leave no logs.
-
Command-and-control beaconing
Regular outbound check-ins from malware to its controller.
- Remember
- Look for periodic connections and unusual DNS.
- Tested as
- Network behavior questions.
- Trap
- Ignoring low-volume regular traffic.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Web attack signatures in logs
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| SQL injection | Injecting SQL through input parameters | Quotes, UNION, OR 1=1, comment markers | Missing URL-encoded quotes |
| Cross-site scripting | Injecting script that runs in a victim's browser | script tags, event handlers, javascript: | Treating it as a server compromise |
| Directory traversal | Reading files outside the web root | Repeated ../ and system file targets | Confusing with remote file inclusion |
| Command injection | Running OS commands through an application | Shell metacharacters such as ; | && | Calling it SQL injection |
Static vs. dynamic malware analysis
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Static | No execution; inspect structure and strings | Safe, fast, defeated by packing | Concluding a packed file is benign |
| Dynamic | Execute in a monitored sandbox | Shows real behavior, may be evaded | Trusting a quiet run as clean |
Cloud evidence sources
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| AWS CloudTrail | API and management activity | Who did what to which resource | Expecting packet data |
| AWS VPC Flow Logs | Network flow metadata | Source, destination, ports, bytes | Expecting payload content |
| Azure Activity Log and Entra ID sign-in logs | Resource operations and authentication events | Control plane and identity evidence | Confusing with VM guest logs |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Wiped means no case
- What candidates pick
- Conclude nothing can be proven after a wiping tool was used.
- Why it looks right
- The target data is gone.
- Why it's wrong
- Wiping tools leave execution artifacts such as prefetch and registry entries, and the act of wiping can itself be evidence.
Clue to watch for The scenario mentions a cleanup or wiping utility.
-
Top-down headers
- What candidates pick
- Read email Received headers from the top to find the origin.
- Why it looks right
- Text is read top to bottom.
- Why it's wrong
- Each server prepends its Received line, so the originating hop is at the bottom.
Clue to watch for The question asks where the email came from.
-
CloudTrail shows traffic
- What candidates pick
- Look in CloudTrail for network connections from an EC2 instance.
- Why it looks right
- CloudTrail is the main AWS log.
- Why it's wrong
- CloudTrail records API calls; network flows are in VPC Flow Logs.
Clue to watch for The question asks about traffic, ports or IP flows.
-
Status 200 proves theft
- What candidates pick
- Conclude data was stolen because an attack request returned 200.
- Why it looks right
- 200 means success.
- Why it's wrong
- A 200 shows the server responded normally, not that the payload worked; response size and content need review.
Clue to watch for The answer options mention verifying response size or content.
-
LNK proves execution
- What candidates pick
- Use a LNK file to prove a program ran.
- Why it looks right
- LNK files reference programs and files.
- Why it's wrong
- LNK files show a file was opened or referenced; prefetch or event logs are stronger proof of execution.
Clue to watch for The question asks specifically about program execution.
-
Signed binary is safe
- What candidates pick
- Dismiss activity by certutil or mshta because they are Microsoft-signed.
- Why it looks right
- Signed system tools are trusted.
- Why it's wrong
- Living-off-the-land attacks misuse trusted binaries to download or run malicious code.
Clue to watch for A system utility makes unexpected network connections.
-
Clean sandbox run
- What candidates pick
- Declare a sample benign after a quiet dynamic analysis.
- Why it looks right
- Nothing malicious was observed.
- Why it's wrong
- Many samples detect virtual machines or wait for triggers before acting.
Clue to watch for Static indicators such as packing conflict with the quiet run.
Answer framework
For Domain 5 analysis questions, identify the environment and evidence type, then reason from the artifact.
- Name the environment: Windows, Linux, Android, network, web application, database, cloud, email or IoT, since each has its own primary evidence sources.
- Check for anti-forensic activity such as wiping, timestomping, hidden streams or encryption, and apply the matching detection method before trusting artifacts.
- Decode and interpret the artifact itself, whether a URL, log line, header or registry entry, and match it to a known attack or activity pattern.
- Corroborate with a second source, such as DHCP logs for an IP or prefetch for execution, before attributing the activity to a device or user.
- For malware, combine static and dynamic findings with system and network behavior, including fileless indicators, to explain persistence and impact.
Practice question
Want more like this? The CHFI practice test has questions for every domain.
Checklist
0 of 14
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Because this domain has seven sub-domains worth only three or four questions each, aim for broad coverage rather than deep expertise. Build a single artifact matrix with rows for each environment, from Windows and Linux to Android, network, web, database, cloud, email and IoT, and columns for the main evidence sources and what each proves. Review it daily.
For anti-forensics, pair every technique with its countermeasure on flashcards. For web attacks, collect ten sample log lines covering the main attack types, include URL-encoded versions, and practise labeling them quickly. For email, take a real header from your own mailbox and trace it bottom to top.
For malware, run a harmless test file through a free online sandbox report and read the sections on processes, registry, files and network; this shows what static and dynamic results look like. Finish with fileless techniques and persistence locations. Older guides describe this domain as much larger, so follow the current blueprint weights when planning hours.
FAQ
How much of the CHFI exam is Domain 5 Digital Forensics?
Digital Forensics is 17% of CHFI v11 under Blueprint v3, about 25 of the 150 questions spread over seven sub-domains.
Why do some sites say Digital Forensics is 25% or more?
They quote the older Blueprint v2. The current v3 blueprint gives this domain 17% and spreads weight more evenly.
Do I need to know Wireshark filters?
Know what packet captures reveal and recognize common attack patterns. Basic filter ideas help, but detailed syntax is not the main focus.
Which cloud providers are covered?
The blueprint names AWS and Azure. Know their main audit, network and identity logs and the limits the shared responsibility model places on access.
How deep is malware analysis on the exam?
It is conceptual and artifact-focused: static versus dynamic techniques, sandbox setup, persistence, network behavior and fileless indicators, not reverse engineering assembly.
Is Android the only mobile platform here?
This sub-domain names Android files. iOS appears in Domain 6 tools and in the v11 mobile forensics module, so review both.
What is the best way to study web attack forensics?
Practise reading real log lines and decoding payloads. Most questions give an entry and ask which attack it shows or whether it worked.
Other Cybersecurity certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
- CompTIA Cybersecurity Analyst+ Study guide
- Microsoft Security Operations Analyst Associate Study guide
- Certified Ethical Hacker Study guide
- Penetration Tester Study guide
- Systems Security Certified Practitioner Study guide
- Certified in Risk and Information Systems Control Study guide
- CompTIA PenTest+ Study guide
- CompTIA SecurityX (CASP+) Study guide
- Azure Security Engineer Associate Study guide
- CISM (Certified Information Security Manager) Study guide
- CISSP Study guide
- CompTIA Security+ Study guide
- Certified Information Systems Auditor Study guide
- Certified Cloud Security Professional Study guide
Test your Domain 5 knowledge
Practise interpreting log lines, headers and artifacts across all seven sub-domains in mixed timed sets before a full mock exam.