CSA (312-39) SOC Simulation Lab

Master the digital forensics and incident response (DFIR) lifecycle. Learn how to bridge the gap between data acquisition and active threat analysis in a real-world SOC environment.

Scenario Context

You are an escalation analyst (Tier 3) responding to a potential ransomware outbreak in your organization's Azure environment. The attacker compromised a hybrid worker's endpoint, pivoted to an on-premise file share, and began encrypting localized data.

The Incident Response (IR) team has just returned from isolating the machine and acquiring a physical bit-by-bit image (E01 format) of the compromised endpoint's drive, alongside a full memory dump.

Security Environment

You review the initial intake ticket from the L1 analyst and the artifact delivery log:

# IR Artifact Delivery Log
[TIMESTAMP] 2023-10-27T14:22:01Z
[STATUS] Drive Acquisition Complete (E01 Format)
[HASH] SHA-256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
[ACTION] Memory Dump (Raw) Acquired.
[CHAIN OF CUSTODY] Signed by John Doe (Responder) -> Transferred to Forensics SAN.
# Analyst Note: Artifacts safely collected and hashed. Awaiting next procedural step.

Question

According to the forensics investigation process, what is the next step carried out right after collecting the evidence?
SOC Hint: You have the raw data sitting on your storage array. Before you can determine *who* did it or *how* they moved laterally (Analysis), you need to make the raw data readable (e.g., bypassing OS passwords, carving out deleted files, filtering out known-good OS files). What is that technical extraction phase called?

Expert Insight

What is happening: The IR team successfully completed the Collection phase by acquiring forensic images and preserving the chain of custody. You now have raw evidence files.

Why Examination is correct: According to standard NIST SP 800-86 and EC-Council DFIR methodologies (Identification -> Collection -> Examination -> Analysis -> Reporting), you cannot analyze raw bits effectively. Examination is the immediate next step. This involves extracting data, recovering deleted files, bypassing OS passwords, decrypting volumes, and filtering out known-good files (like NSRL hash sets) to prepare the data for actual analysis.

Why the others are wrong:

  • Analysis happens after examination. Analysis is where you piece the extracted artifacts together to answer the who, what, when, where, and how (e.g., building a timeline of lateral movement).
  • Identification happens before collection (recognizing that an incident occurred and identifying which assets to seize).
  • Reporting is the final step where you present findings to stakeholders.

SOC Mini-Lesson: Examination vs. Analysis

Junior analysts often confuse Examination and Analysis. Here is the easiest way to remember it on the SOC floor:

Examination = The "Tech" Work. Using tools like Autopsy, FTK, or Volatility to mount the image, carve out a deleted prefetch file, or extract the SAM hive.

Analysis = The "Detective" Work. Taking that extracted SAM hive, looking at the user creation timestamps, correlating it with Windows Event ID 4624 (Successful Logon) from your SIEM, and proving the attacker created a persistence account at 2:00 AM.

Explore more CSA simulations and practice tests →