CHFI OS and Network Forensics Practice Question
Which tool is commonly used in timeline analysis for digital forensics to parse various artifacts and create a super timeline?
⚠ Common exam trap
EC-Council often tests the distinction between low-level filesystem tools (like Sleuth Kit) and high-level artifact parsing tools (like log2timeline/Plaso), leading candidates to mistakenly choose Sleuth Kit because they associate 'timeline analysis' with file timestamps (MAC times) rather than the comprehensive super timeline that aggregates multiple artifact types.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
log2timeline / Plaso
log2timeline (now part of the Plaso framework) is specifically designed to parse a wide variety of digital forensic artifacts—such as Windows Event Logs, Prefetch files, registry hives, and browser history—and aggregate them into a single, unified super timeline. This super timeline allows investigators to correlate events across different data sources and identify sequences of activity with precise timestamps, which is essential for timeline analysis in OS and network forensics.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Volatility
Why it's wrong here
Volatility is a specialized memory forensics framework that extracts volatile artifacts from RAM dumps, such as running processes, network connections, kernel objects, and injected code. It does not parse file system metadata, event logs, or other non-volatile artifacts across a disk image, so it cannot correlate timestamps from multiple sources to construct a system-wide timeline. Its timestamp data is limited to what happens to be in memory at acquisition time, making it unsuitable for chronological event reconstruction. Thus, it is used for memory analysis, not timeline generation.
- ✗
Wireshark
Why it's wrong here
Wireshark is a network protocol analyzer that captures and dissects packets in real time or from PCAP files, focusing on network traffic, protocol headers, and payloads. While it displays packet timestamps and can filter communications within a session, it does not ingest forensic disk images nor parse file system metadata, registry hives, or application logs. Timeline analysis requires aggregating artifacts from the host's persistent storage, which Wireshark is not designed to do. Therefore, it is a wrong tool for building a digital forensics timeline of system activity.
- ✗
Sleuth Kit
Why it's wrong here
The Sleuth Kit (TSK) is a collection of command-line file system forensic tools including fls, icat, and mmls that inspect disk images and extract file system metadata. Although TSK includes the 'mactime' utility to generate a MAC (modification, access, change) timeline from file system data, it does not natively parse and correlate non-file-system artifacts such as Windows Event Logs, browser history, or registry timestamps. TSK's timeline capability is file-system-centric and limited to a single data source, whereas comprehensive timeline analysis requires aggregating events from diverse artifacts. Thus, TSK is not the dedicated multi-source timeline analysis tool.
- ✓
log2timeline / Plaso
Why this is correct
log2timeline (now evolved into Plaso) is the definitive open-source tool for digital forensics timeline analysis. It recursively parses a disk image or collection of files, using numerous parsers to extract timestamps from file system metadata, operating system logs, application traces, browser history, registry keys, and many other artifact types. All parsed timestamps are normalized into a unified SQLite database, enabling the investigator to generate a 'super timeline' that correlates events across multiple sources for temporal reconstruction. This comprehensive multi-source approach is exactly what timeline analysis demands, making it the correct answer.
Go deeper
Related to this question
Learn chapter
Overview of Computer Forensics and Investigation Process
Key term
FTK Imager
FTK Imager is a free forensic imaging tool used to create exact copies of computer drives and storage devices for digital evidence analysis.
Key term
Forensic Evidence Collection
Forensic evidence collection is the process of identifying, preserving, and gathering digital data from computers and devices in a way that keeps it valid for use in legal investigations or internal incident response.
About these practice questions
One of 205 original CHFI practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.