Digital Forensics and Incident Response - Second Edition

Analyzing Network Evidence

Chapter 4, Collecting Network Evidence, explored how incident responders and security analysts are able to acquire network-based evidence for later evaluation. That chapter focused on two primary sources of that evidence, network log files and network packet captures. This chapter will show which tools and techniques are available to examine the evidence acquired. Incorporating these techniques into an incident response investigation can provide incident response analysts with insight into the network activity of possible threats. In this chapter, the following main topics will be addressed:

• Network evidence overview: Adversaries are bound to the same network protocols that govern normal network traffic. Adversarial ...