EC-Council CSA · Domain 7 of 8

EC-Council CSA Domain 7: Forensics Investigation and Malware Analysis

A 5% CSA v2 domain new in v2. It gives SOC analysts the investigation skills to support response: forensic principles, investigating network, application, email and insider incidents, and static and dynamic malware analysis.

Exam weight
5%
Official objectives
8
Estimated questions estimate
~5
Suggested study time estimate
5–7 hrs

About 12 min read Reviewed October 2026

Overview

Domain 7 brings forensic thinking into the SOC. It is not a full forensics certification; it covers what an analyst needs to investigate incidents soundly and hand evidence to specialists. The first objective covers forensic investigation basics: the investigation process, chain of custody, order of volatility, write-blocking, hashing to prove integrity, and working on copies rather than originals.

Four objectives apply this to incident types. Network investigations use packet captures, flow data and device logs. Application investigations reconstruct attacks from web, WAF and database logs. Email investigations read message headers to trace the true origin and check authentication results. Insider investigations combine access logs, DLP alerts, removable media records and user activity timelines. The last three objectives cover malware analysis: why it is done, static analysis of a sample without running it, and dynamic analysis in an isolated sandbox to observe behavior.

How it's tested

Questions are short and principle-driven. They describe an investigation step and ask whether it preserves evidence, which data source answers a question, how to read an email header, or whether a technique is static or dynamic analysis. Order of volatility and chain of custody appear frequently.

  • Preserve or destroy

    An action on a suspect system is described, and you judge whether it protects evidence integrity or the better alternative.

  • Trace the source

    Email headers, flow records or web logs are shown, and you identify the origin or path of the attack.

  • Static or dynamic

    A malware analysis activity is described, and you classify it or pick the safer method for the goal.

Reasoning it through

An analyst must collect data from a running server suspected of hosting malware. Copying the disk image first is tempting because disks hold most data, but memory, running processes and network connections disappear on shutdown. Following the order of volatility, the analyst captures RAM and live network state first, then images the disk with a write blocker and records hashes in the chain of custody.

Objectives 8

Official objectives from the EC-Council outline, in outline order.

7.1 Understand about Forensic InvestigationPrinciples of sound digital investigation.
What it means
Forensic investigation is the methodical collection, preservation, analysis and reporting of digital evidence so that findings are accurate and defensible. For SOC analysts it means supporting incident response without damaging evidence.
What to understand
Key principles are documenting every action, maintaining chain of custody, collecting in order of volatility from registers and memory to disk and archives, using write blockers when imaging, hashing originals and copies with SHA-256 or similar to prove integrity, and analyzing copies only. Time zones and clock offsets must be recorded so timelines line up.
How it shows up
Questions test chain of custody, order of volatility or which action preserves integrity.
Common confusion
Analyzing the original drive directly instead of a verified forensic image.
7.2 Investigating Network Security IncidentsReconstructing attacks from network evidence.
What it means
Network investigation uses full packet captures, NetFlow or IPFIX records, firewall, proxy and DNS logs, and IDS alerts to find what traffic occurred, between which hosts and when.
What to understand
Packet captures show content and are read with tools such as Wireshark or tcpdump; flow records show who talked to whom, how much and how long, without content. DNS logs reveal domains contacted, and regular, similar-sized connections can indicate beaconing. Encrypted traffic limits content analysis, so metadata, certificates and JA3-style fingerprints become important.
How it shows up
A network question asks which evidence source answers a specific investigative question.
Common confusion
Expecting NetFlow records to contain packet payloads.
7.3 Learn to Investigate Application Security IncidentsReconstructing attacks against applications.
What it means
Application investigations reconstruct how an attacker abused an application, using web server access and error logs, WAF logs, application logs, database audit logs and file system changes.
What to understand
Analysts build a timeline from the first probing requests to successful exploitation, identify the attacker's IP addresses and user agents, look for uploaded web shells by checking recently modified files in web directories, and confirm what data was queried using database logs. Correlating timestamps across tiers shows the full chain from request to data access.
How it shows up
Expect questions on which artifact proves exploitation or data access.
Common confusion
Concluding no data was stolen because web logs alone show no errors.
7.4 Learn to Investigate Email Security IncidentsTracing and validating suspicious messages.
What it means
Email investigation analyzes full message headers, body content, links and attachments to determine the true sender, the path the message took and whether it is malicious.
What to understand
Received headers are added by each mail server, so the trail is read from the bottom up to find the originating server. Compare the From, Reply-To and Return-Path addresses, check SPF, DKIM and DMARC results in Authentication-Results, and examine the Message-ID. Links should be checked in a safe environment and attachments hashed and analyzed in a sandbox.
How it shows up
Headers are shown, and you identify the originating server or a spoofing sign.
Common confusion
Reading Received headers top to bottom and naming the last relay as the origin.
7.5 Learn to Investigate Insider IncidentsBuilding evidence about misuse by trusted users.
What it means
Insider investigations gather evidence of what a trusted user accessed, copied or sent, using authentication logs, file access audits, DLP alerts, USB and removable media records, email and cloud storage activity, and endpoint telemetry.
What to understand
The goal is a factual timeline linking the user's identity to specific actions, ruling out a compromised account. Investigations must respect privacy law and company policy and be coordinated with HR and legal. Evidence should be collected discreetly and preserved with chain of custody in case of disciplinary or legal action.
How it shows up
A scenario asks which evidence links a user to data theft or how to keep the investigation sound.
Common confusion
Assuming a username in a log proves the person acted, without ruling out account compromise.
7.6 Understand Malware AnalysisPurpose and approaches of analyzing malicious code.
What it means
Malware analysis studies a suspicious sample to learn what it does, how it persists and spreads, and what indicators it leaves, so responders can detect, contain and eradicate it.
What to understand
Approaches are static analysis without execution, dynamic analysis by running the sample in a controlled environment, and deeper code analysis or reverse engineering. Analysis must be done in an isolated lab with snapshots, no connection to production, and controlled or simulated internet access. Outputs feed IoCs, YARA rules and detection content.
How it shows up
Expect questions on why malware is analyzed and how to set up a safe lab.
Common confusion
Running a sample on a production machine or one connected to the corporate network.
7.7 Learn to Perform Static Malware AnalysisExamining a sample without running it.
What it means
Static analysis inspects the file itself: computing hashes, checking them against reputation services, extracting strings, examining PE headers, sections and imported functions, and detecting packing or obfuscation.
What to understand
Imports such as networking or process injection APIs hint at capability, and high entropy or few readable strings suggest packing. Tools include hashing utilities, strings, PE viewers such as PEStudio, and YARA. Static analysis is safe and quick but can be defeated by packing and encryption, so it is usually followed by dynamic analysis.
How it shows up
An activity is described, and you decide whether it is static analysis or what a finding suggests.
Common confusion
Calling sandbox execution static analysis because no debugger was used.
7.8 Learn to Perform Dynamic Malware AnalysisObserving a sample's behavior while it runs.
What it means
Dynamic analysis executes the sample in an isolated sandbox or virtual machine and monitors processes, file and registry changes, network activity and persistence mechanisms.
What to understand
Tools include automated sandboxes, Process Monitor, Process Explorer, Regshot for registry comparison, and Wireshark or simulated network services such as INetSim. Snapshots let the analyst revert after each run. Some malware detects virtual machines or delays execution to evade sandboxes, so a clean result does not prove a sample is harmless.
How it shows up
Expect questions on what dynamic analysis reveals or why a sample may appear benign in a sandbox.
Common confusion
Treating a quiet sandbox run as proof that a file is safe.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Chain of custody

    Documented record of who handled evidence, when and why.

    Remember
    Gaps undermine evidence credibility.
    Tested as
    Evidence handling questions.
    Trap
    Forgetting to log transfers.

  • Order of volatility

    Collect the most short-lived data first, such as memory before disk.

    Remember
    RFC 3227 is the usual reference.
    Tested as
    Collection order questions.
    Trap
    Imaging disk before capturing RAM.

  • Write blocker

    Hardware or software that prevents writes to evidence media.

    Remember
    Protects the original during imaging.
    Tested as
    Integrity questions.
    Trap
    Imaging without one.

  • Hash verification

    Comparing hashes of original and image to prove they match.

    Remember
    Use strong algorithms such as SHA-256.
    Tested as
    Integrity questions.
    Trap
    Relying on file size or timestamps.

  • NetFlow

    Flow metadata: endpoints, ports, bytes, duration.

    Remember
    No payload content.
    Tested as
    Network evidence questions.
    Trap
    Expecting packet content.

  • Packet capture

    Full recording of network packets.

    Remember
    Shows content when unencrypted.
    Tested as
    Network evidence questions.
    Trap
    Underestimating storage needs.

  • Received headers

    Server-added trail showing an email's path.

    Remember
    Read from bottom to top.
    Tested as
    Email investigation questions.
    Trap
    Reading top-down for origin.

  • Return-Path vs. From

    Envelope bounce address versus displayed sender.

    Remember
    Mismatch can indicate spoofing.
    Tested as
    Header analysis questions.
    Trap
    Trusting the display name.

  • Static analysis

    Examining a file without executing it.

    Remember
    Safe, quick, defeated by packing.
    Tested as
    Method questions.
    Trap
    Calling it dynamic.

  • Dynamic analysis

    Running a sample in a sandbox to watch behavior.

    Remember
    Reveals runtime actions and network traffic.
    Tested as
    Method questions.
    Trap
    Running it on a connected host.

  • Packing

    Compression or encryption that hides malware code.

    Remember
    High entropy and few strings are clues.
    Tested as
    Static analysis questions.
    Trap
    Assuming few strings means benign.

  • Sandbox evasion

    Malware that detects analysis environments or delays execution.

    Remember
    A clean run is not proof of safety.
    Tested as
    Dynamic analysis questions.
    Trap
    Trusting a quiet sandbox report.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Static vs. dynamic malware analysis

ConceptMeaningKey differenceCommon trap
Static Inspect hashes, strings, headers, imports Sample not executed Missing packed code
Dynamic Run in sandbox and monitor behavior Sample executed in isolation Lab not isolated

Network evidence sources

ConceptMeaningKey differenceCommon trap
Full packet capture Complete packets including payload Most detail, most storage Assuming encrypted content is readable
NetFlow or IPFIX Connection metadata Scales well, no content Expecting payloads
DNS logs Domain queries and answers Reveals contacted domains Ignoring them in C2 cases

Email header fields

ConceptMeaningKey differenceCommon trap
Received Hop-by-hop server trail Bottom entry is nearest the origin Reading top-down
From Displayed sender Easily spoofed Trusting it alone
Return-Path Envelope bounce address Used for SPF checks Ignoring a mismatch
Authentication-Results SPF, DKIM, DMARC outcomes Summarizes validation Treating pass as safe

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Disk first

    What candidates pick
    Image the hard drive before anything else.
    Why it looks right
    The disk holds the most data.
    Why it's wrong
    Memory, processes and connections are lost first, so order of volatility puts them earlier.

    Clue to watch for The system is still running.

  2. Top header is origin

    What candidates pick
    Name the server in the first Received header as the sender's origin.
    Why it looks right
    It appears first in the header block.
    Why it's wrong
    Each server prepends its header, so the earliest hop is at the bottom.

    Clue to watch for Several Received lines are shown.

  3. Analyze the original

    What candidates pick
    Run analysis tools directly on the seized drive.
    Why it looks right
    It saves time.
    Why it's wrong
    Tools may alter the original; analysis belongs on a hash-verified copy.

    Clue to watch for The question stresses legal use of evidence.

  4. Quiet sandbox means benign

    What candidates pick
    Close the case because the sandbox showed no activity.
    Why it looks right
    No malicious behavior was observed.
    Why it's wrong
    Many samples detect virtual machines or wait before acting.

    Clue to watch for The file is packed or from a known threat actor.

  5. NetFlow shows content

    What candidates pick
    Use NetFlow to read the data exfiltrated.
    Why it looks right
    It records network activity.
    Why it's wrong
    Flow records hold metadata only; content needs packet capture.

    Clue to watch for The question asks what data was sent.

  6. Username proves identity

    What candidates pick
    Conclude the employee stole data because their account did.
    Why it looks right
    The log names the user.
    Why it's wrong
    The account may have been compromised; corroborating evidence is needed.

    Clue to watch for Phishing or unusual logon sources are mentioned.

Answer framework

Apply these steps to Domain 7 questions about investigation and malware analysis.

  1. Decide what must be proven, such as origin, scope, data access, user responsibility or malware capability, because the goal decides which evidence matters.
  2. Choose the evidence source that can actually prove it: packet capture, flow data, web or database logs, email headers or endpoint records.
  3. Collect in order of volatility, use write blockers, hash everything and record each handover in the chain of custody form with time and name.
  4. For malware, start with static analysis for quick indicators, then move to dynamic analysis in an isolated, snapshot-based lab.
  5. Corroborate findings across at least two independent sources before concluding, and feed resulting indicators back into hunting and detection content.

Practice question

An analyst receives a suspicious executable. Without running it, they calculate its SHA-256 hash, extract readable strings, and view its imported functions, finding calls related to process injection. What type of analysis has the analyst performed?

Want more like this? The EC-Council CSA practice test has questions for every domain.

Checklist

0 of 12

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Keep this domain focused and practical; about a week of evening sessions is enough. Start with principles: write out the order of volatility, then practice describing chain of custody for a laptop seized during an incident, including hashing at each step.

Next, practice reading evidence. Open a sample packet capture in Wireshark and follow a TCP stream, then compare what the same connection would look like as a flow record. Take a real email from your own inbox, view its full headers, and trace the Received lines from bottom to top, noting SPF, DKIM and DMARC results. Annotate a few web log lines to reconstruct an attack timeline.

Finally, cover malware analysis safely. Use benign test files or published training samples in an isolated virtual machine; compute hashes, run strings and open a PE viewer for static work, then run Process Monitor and Regshot around a harmless executable to see what dynamic analysis captures. Five questions come from this domain, so aim for confident recall of the principles.

FAQ

How much of the CSA v2 exam is Forensics Investigation and Malware Analysis?

Forensics Investigation and Malware Analysis is 5% of the blueprint, about five of the 100 questions. It is a new domain in CSA v2.

Is this the same as the CHFI certification?

No. CSA covers forensic basics a SOC analyst needs to support response. EC-Council's CHFI goes much deeper into forensic methods and tools.

What is the order of volatility?

The sequence for collecting evidence from most to least short-lived, such as CPU state and memory, then network state and running processes, then disk, then archives.

How do I find where an email really came from?

Read the Received headers from bottom to top. The lowest one added by a trusted server usually shows the originating server and IP.

What is the difference between static and dynamic malware analysis?

Static analysis inspects the file without running it. Dynamic analysis runs it in an isolated environment and records its behavior.

Why might malware look harmless in a sandbox?

Some samples detect virtual machines, check for user activity or delay execution, so they stay dormant during short automated runs.

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 7 knowledge

You have covered forensic principles, network, application, email and insider investigations, and static and dynamic malware analysis. Test whether you handle evidence correctly.

Take the EC-Council CSA practice test Check your EC-Council CSA readiness

Keep going