According to theCHFI v11 Network and Web Attacksdomain, adirectory traversal attack(also known as path traversal) is a web-based attack in which an attacker manipulates input parameters (such as ../ sequences) to access files and directoriesoutside the intended web root. This can expose sensitive resources such as configuration files, credentials, source code, system files, and application logs.
Theprimary forensic objectivewhen investigating a directory traversal attack is todetermine the scope and impact of unauthorized access. CHFI v11 emphasizes that investigators must analyzeweb server logs, application logs, and access recordsto identify:
Which files or directories were accessed
Whether sensitive or confidential data was exposed
The time frame of the attack
The attacker’s source IP and request patterns
Whether data was viewed, downloaded, or potentially modified
Understanding theextent of data compromiseis critical for incident response, regulatory notification, damage assessment, and legal proceedings. It also helps determine whether further attacks (such as privilege escalation or lateral movement) may have occurred following the traversal exploit.
The other options are not aligned with forensic goals. Hardware configuration analysis and bandwidth optimization are operational tasks, not forensic objectives. Enhancing user experience is unrelated to incident investigation.
CHFI v11 clearly states that the focus of web attack forensics isimpact assessment and evidence reconstruction, makingdetermining unauthorized access and data compromisethe correct objective.
Therefore, the correct and CHFI v11–verified answer isOption C.
