The Process Of Network Forensics Process

Protocol capture tools and protocol analyzers are important tools for an information systems security professional. These utilities can be used to troubleshoot issues on the network. They can verify adherence to corporate policies, such as whether or not clear text privacy data is being sent on the network. They can be used to test security countermeasures and firewall deployments and are needed to perform audits, security assessments, network baseline definitions, and identification of rogue IP devices.

Where can we find evidence in the network? In chapter 12 of our textbook it tells us how to find evidence on the netbook. There are different types of network, where you can find evidence. “The type of evidence that can be retrieved from networks includes full contact data (i.e., the entire contents of packets) and session data (i.e., traffic data.)” Some of these items can be…

tools will help to detect intrusions and other suspicious activities on the network. The third challenge is to improve the

For this reason, it is imperative that the information gathered is reliable and accurate to ensure the evidence collected can be utilized by the digital forensic investigator for the current case (Ingalls & Rodriguez, 2011). Additionally, cyber incidents require digital forensic investigators to interview various individuals regarding the information needed for the case. According to the National Institute of Justice (2004), interviewing the system administrator, users, and employees of an organization regarding a cyber incident would provide investigators with valuable information; for example, user accounts, email accounts, network configuration, logs, and passwords. Furthermore, for digital forensic investigators to conduct an effective interview, they must have the proper tools and training to employ the interview process. For instance, formal procedures or instructions should be developed and implemented to ensure that the investigator follows a standard during all investigations. Additionally, training should be provided to ensure that digital forensic investigators comprehend by what means to prepare, conduct, and evaluate an interview. Furthermore, resources should be made available for digital forensic investigators to accomplish their tasks; for example, recording devices and references. Also, definitions should be provided to the digital forensic investigators for

The aim of this report is to examine Computer Forensics and Anti Forensics in details, investigation and Analysis techniques, and standard set of procedures which Forensics investigators must follow

This means that digital evidence is hard to destroy and that in order to completely remove the evidence from the internet, one must possess a high level of knowledge in the area (Casey, 2011, p.26). This means that criminals who conduct online crimes will always leave online trails and it is up to the digital forensic scientists to retrieve the evidence (Casey, 2011, p.26). This is a strength and it also shows us why digital forensic scientists can play a crucial role as they are the few people that are trained in locating the trail of evidence left behind by the

With the increasing usage of social networks and the emergence of cloud computing, digital forensics face a number of research problems and challenges. The number of users of these services increases steadily, with Facebook (the largest current social network) claiming to have 800 million users. While traditional forensics relies on the physical acquisition of hardware and the usage of hashsums to ensure evidence reliability, this approach does not scale to cloud services and their use of distributed datacenters. With the lack of standardized forensics APIs as well as unified processes for service operators, isolated solutions are still in widespread use. Another important aspect of forensics is the proper visualization of data due to the vast amount of available data.

FORENSICS’, its uses, the users of computer forensics, steps involved in this type of forensic

In a world where technology is increasingly becoming the way of life, it was only a matter of time before crime was no longer just in the streets but happening online as well. Criminals now get a new approach to carry out their crimes with the use of computers. Since technology is more like a murder mystery than catching the bad guy in the act, a new discipline of forensics needed to be put into place. This is known as computer forensics. Forensic science is any science used for the purpose of law. In the case of computer forensics it is “the discipline that combines elements of law and computer science to collect and analyze data from computer systems, networks, wireless communications, and storage devices in a way that is admissible as evidence in a court of law” (U.S. Cert, 2008). Meaning if you do something illegal on the Internet it can be found.

Computer forensics is acquiring great importance now a days due to the increasing value of information and the use given.

The goal of this case study is to follow a packet capture file to investigate the fictitious character Ann Dercover. Examining the file will show how she uses network tunneling to cover her tracks, but more importantly, it will help develop skills that can be applied to network forensics. The challenge is to determine if the DNS traffic is truly suspicious, determine the purpose of the DNS traffic, recover all possible information on the local and remote systems involved, and the risk associated with the data leaking from the organization.

This method contains four main phases which are investigation preparation, Response, collection and securing digital evidence, delivering evidence, confirmation, and examination and analysis. This method can be used when investigating different types of digital devices. The author discussed the method of how to extract online conversation if suspect’s logs go through a web browser. The method provides the process which forensically sounds manner and gives proper handling of online social media investigation.

There can be a number of technical issues that a network forensic investigator may come across. They must be up to date with relevant and the latest knowledge concerning computer technical issues and general network architecture. It is essential that a forensic investigator must have up to date tools and techniques at their disposal. Attacks on networks are becoming a lot more sophisticated, making it harder to figure out the source of the attack, hence why it is necessary to keep up to date with forensic tools and techniques.

The very first step in auditing networks is to define where to analyze the traffic. Taking a common scenario for analysis, the following assumptions were made. There is a switched network made up of a number of switches, several terminals and a file server. Network performance has dropped, however the cause is unknown. There is no IDS (Intrusion Detection System) that can alarm or inform about attacks or network malfunction. Also, it is known that there are no problems with the transfer rate of the file server to LAN (Local Area Network) terminals [3]. Furthermore, network equipment does not have Netflow protocols to analyze traffic remotely. Wireshark was chosen to analyze the above scenario. The first doubt which arises is where to install Wireshark. It would seem logical to install Wireshark on the file server itself to analyze the traffic that flows through this network segment. However, there could be situations in which there is no access to the server physically or quite simply for security reasons. Thus, Wireshark cannot be installed there. Some alternatives are provided in the following paragraphs that enable to capture traffic without having to install Wireshark on the server.

Certified that Sakshi Bansal (21341314008), has carried out the research work presented in this thesis entitled "A PROPOSED FRAMEWORK FOR NETWORK FORENSICS INQUISITION & RELATIVE SUBSTANTIATION WITH OTHER FRAMEWORKS" for the award of Master of Technology from Uttaranchal University, Dehradun under my supervision. The thesis embodies results of original work, and studies are carried out by the student herself and the contents of the thesis do not form the basis for the award of any other degree to the candidate or to anybody else from this or any other University/Institution.