Digital Forensics and Incident Response - Third Edition

9

Analyzing Network Evidence

Chapter 5 explored how incident responders and security analysts can acquire network-based evidence for later evaluation. That chapter focused on two primary sources of that evidence: network log files and network packet captures. This chapter will show you which tools and techniques are available to examine the evidence acquired. Incorporating these techniques into an incident response investigation can provide incident response analysts with insight into the network activity of possible threats.

In this chapter, the following main topics will be addressed:

• Network evidence overview
• Analyzing firewall and proxy logs
• Analyzing NetFlow
• Analyzing packet captures

Network evidence overview

Adversaries are bound to ...