Forensics Investigation and Malware Analysis · Topic 1 of 3
Forensic Investigation and Investigating Network Incidents
Learn the forensic investigation process, evidence handling, chain of custody and how to investigate network security incidents for the CSA 312-39 exam.
- 5 min
- Investigate copies, never originals, and prove integrity with matching hashes.
- Collect in order of volatility, memory before disk.
- Chain of custody records every handover of evidence.
What it is
Forensic investigation is the collection, preservation, analysis and reporting of digital evidence in a way that keeps it reliable and, if needed, acceptable in court. In the SOC it answers the questions an incident leaves behind: what happened, how, when, which systems and data were affected, and who was responsible.
Investigating a network security incident applies the same discipline to network evidence: logs, flow records and packet captures.
How it works
The investigation process
EC-Council describes three broad phases of a forensic investigation.
| Phase | Main activities |
|---|---|
| Pre investigation | Build the forensic capability: trained staff, tools, lab, procedures, legal approval |
| Investigation | Secure the scene, collect and preserve evidence, analyze it, build the timeline |
| Post investigation | Write the report, present findings, testify if required |
The SOC analyst is often the first responder: the first trained person to handle the scene. Their job is to secure, preserve and document, not to dig in with tools that change the evidence.
Evidence handling rules
| Rule | Why it matters |
|---|---|
| Work on a forensic copy | The original stays untouched |
| Use a write blocker for disks | Prevents the analysis machine from changing the source |
| Hash the original and the copy | Matching hashes (for example SHA-256) prove the copy is identical |
| Keep a chain of custody | Records who held the evidence, when, and why, from collection to court |
| Document everything | Times, actions, tools and who did them |
Volatile data (memory, running processes, network connections, logged on users) is lost at power off. Nonvolatile data (disks, logs on disk, removable media) survives. RFC 3227 sets the order of volatility: collect registers and cache, then routing table, ARP cache, process table and memory, then temporary files, then disk, then remote logs, then physical configuration and topology, then archives.
Rules of evidence
Evidence is useful only if it is admissible (allowed under law), authentic (it is what you say it is), complete (tells the whole story), reliable (collected in a sound way) and believable (clear to a judge or jury).
Network evidence sources
| Source | What it answers |
|---|---|
| Firewall logs | Which connections were allowed or denied, and from where |
| IDS or IPS alerts | Which signatures matched and when |
| Proxy logs | Which URLs internal users visited |
| DNS logs | Which domains hosts resolved, useful for command and control |
| NetFlow or IPFIX | Who talked to whom, how much data moved, for how long |
| Full packet capture | Exact content of sessions, files transferred |
| DHCP logs | Which device had which IP address at a given time |
| VPN and authentication logs | Who connected remotely and from where |
Investigating a network incident
Map each IP to a device and user at the right time, because addresses change. Then line up firewall, proxy, DNS and flow records into one timeline, using synchronized time (NTP) so events from different devices line up.
Packet analysis with tools such as Wireshark or tcpdump shows the protocol details, transferred files and commands. Zeek turns traffic into structured logs of connections, DNS, HTTP and files.
Signs analysts look for in network evidence
| Pattern | Possible meaning |
|---|---|
| Regular small connections to one external IP | Malware beaconing to command and control |
| Large outbound transfer at night | Data exfiltration |
| Many DNS queries with long random subdomains | DNS tunneling or a domain generation algorithm |
| Internal host connecting to many internal hosts on SMB or RDP | Lateral movement |
| Traffic on unusual ports for a known protocol | Evasion or a backdoor |
A worked example
A proxy alert shows a finance laptop sending 4 GB to an unfamiliar cloud address at 02:00. The analyst uses DHCP logs to confirm which laptop held that IP at that time, and NetFlow to confirm the volume and duration.
DNS logs show the domain was first resolved that night, and packet capture of a later session shows an encrypted upload. The analyst preserves the logs with hashes, records the chain of custody and builds a timeline for the incident report.
How the exam asks about this
- "Which document records every person who handled a piece of evidence?" → The chain of custody.
- "Which evidence should be collected first, disk or memory?" → Memory, because it is more volatile.
- "Which log tells you which device had a given IP address at a certain time?" → DHCP logs.
What to remember for the exam
- Investigate copies, never originals, and prove integrity with matching hashes.
- Collect in order of volatility, memory before disk.
- Chain of custody records every handover of evidence.
- Evidence must be admissible, authentic, complete, reliable and believable.
- NetFlow shows who talked to whom and how much; packet capture shows the content.
Running analysis tools directly on a suspect system changes timestamps and files. Capture first, then analyze the copy.
Common mistakes
Ignoring time sync. Logs from devices with different clocks produce a wrong timeline.
Trusting an IP address as a user. Addresses are reassigned, so use DHCP and authentication logs to map them at that moment.
Skipping documentation. Undocumented steps make evidence easy to challenge.
Check yourself
What proves a forensic image matches the original?
Identical cryptographic hashes calculated on the original and the copy.
Which network pattern suggests command and control beaconing?
Regular, small connections from a host to the same external address at fixed intervals.
What does a write blocker do?
It allows reading a disk while preventing any write that would change the evidence.
Topic 1 of 3 in Forensics Investigation and Malware Analysis
Test yourself on Forensics Investigation and Malware Analysis
The full EC-Council 312-39 question bank has 700 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.