I85PREP
⌘ K
Mile2 CDFE study materials
Mile2 CDFE study resources

Mile2 CDFE: Network and Log Forensics

Mile2 CDFE · Work through your exam, one topic at a time.

All guide sections

Network and Log Forensics

Domain 4 - Network and Log Forensics

This domain tests reconstruction of network activity from packets, flows, and logs, and the limits of each source. Expect questions on PCAP, NetFlow, firewall/proxy/DNS/DHCP logs, Windows Event Logs, syslog, time synchronization, and correlation.

Core rules

  • Full packet capture records content and headers; flow data (NetFlow/IPFIX) records metadata only; both answer different questions. Capture at a span port or tap, with sufficient storage and a documented capture filter.
  • Logs are volatile and often retained briefly. Prioritize central log servers, then hosts. Record the time source and offset; NTP drift and timezone differences break timelines.
  • Map IP addresses to devices using DHCP leases, NAT translations, VPN logs, and asset inventories. Without that mapping, an IP is not a person or host.
  • Windows Event Logs: Security log for logon and audit events (e.g., 4624, 4625, 4688), System log for service and driver events, PowerShell logs for script activity. Syslog severity/priority and facility fields vary by daemon.
  • Corroborate: a proxy log shows a URL request, DNS shows resolution, firewall shows an allowed flow, and host artifacts show execution. One log line is a lead, not a conclusion.
  • Preserve log integrity: hash exports, record the collection method, avoid editing, and note gaps and retention limits.

Worked example

A host appears to beacon every 60 seconds. The examiner filters firewall and proxy logs for the destination, checks NetFlow for periodic small outbound flows, reviews DNS for repeated lookups, then captures PCAP if the traffic is ongoing. Reasoning: periodicity across independent sources supports command-and-control behavior; a single proxy hit could be a user click. The report states the observed pattern, time window, and confidence, not just 'malware.'

Traps

Treating an IP as a user; ignoring NAT and DHCP lease times; mixing UTC and local time; assuming logs are complete; analyzing only one source; forgetting encrypted traffic limits content visibility; failing to document the capture point.