CHFI OS and Network Forensics Practice Question
Which TWO of the following are tools that can be used for timeline analysis in digital forensics?
⚠ Common exam trap
EC-Council often tests the distinction between tools used for network analysis (Wireshark, Nmap) versus tools used for host-based timeline analysis (log2timeline, Plaso), leading candidates to confuse packet capture utilities with forensic timeline generators.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
log2timeline
log2timeline (C) is correct because it is the original Perl-based tool designed to parse many artifact sources and generate a bodyfile of timestamped events, which is the foundational step of building a forensic timeline. Plaso (E) is correct because it is the successor to log2timeline, and its psort.py utility correlates and sorts the parsed events into a super-timeline for chronological analysis. Wireshark (A) is a network protocol analyzer for capturing and inspecting packet traffic, not a timeline generator. Nmap (B) is a network discovery and port-scanning tool used for host and service enumeration. FTK Imager (D) is an imaging and preview tool for acquiring and browsing forensic images, not a timeline analysis tool.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Wireshark
Why it's wrong here
Wireshark captures and decodes network packets; it does not build a filesystem or event timeline from host artefacts. It is tempting because it displays packet timestamps, and would be correct for analysing network traffic captures, but timeline analysis requires tools that correlate MAC times and log entries.
- ✗
Nmap
Why it's wrong here
Nmap scans hosts and ports to map network services; it produces no chronological event timeline from forensic artefacts. It is tempting because it reports timestamps and is a familiar reconnaissance tool, and would be correct for host discovery or port enumeration, not for correlating file and log timestamps.
- ✓
log2timeline
Why this is correct
log2timeline aggregates timestamped artefacts from filesystems, registry hives, browser histories and logs into a single chronological bodyfile, directly satisfying the stem's timeline-analysis requirement. Its super-timeline output lets investigators correlate events across disparate sources, which is precisely the capability the question demands.
- ✗
FTK Imager
Why it's wrong here
FTK Imager acquires and verifies forensic images and browses their contents; it does not construct or render a chronological timeline of events. It is tempting because it is a core forensic tool, and would be correct when the task is creating a disk image or previewing files rather than correlating timestamps across artefacts.
- ✓
Plaso
Why this is correct
Plaso builds super-timelines by parsing timestamps from disparate artefacts into a single chronological output, directly satisfying the question's requirement for timeline analysis tools. Its log2timeline backend aggregates file system, registry and event log metadata, enabling investigators to correlate activity across sources during forensic examination.
Go deeper
Related to this question
Learn chapter
Malware Forensics: Reverse Engineering and Analysis
Key term
Memory Acquisition
Memory acquisition is the process of capturing the contents of a computer's volatile memory to preserve data for forensic analysis and incident response.
Key term
FTK Imager
FTK Imager is a free forensic imaging tool used to create exact copies of computer drives and storage devices for digital evidence analysis.
About these practice questions
This CHFI question is part of Courseiva's 745-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.