Digital Forensics and Incident Response - Second Edition

Analysis

Once the examination phase has extracted potentially relevant pieces of data, the digital forensics examiner then analyzes the data in light of any other relevant data obtained. For example, if the digital forensics analyst has discovered that a compromised host has an open connection to an external IP address, they would then correlate that information with an analysis of a packet capture taken from the network. Using the IP address as a starting point, the analyst would be able to isolate that particular traffic. From here, the analyst may be able to determine that the compromised host is sending out a beacon to a C2 server. From here, using additional sources, the analyst may be able to determine which particular attack vector ...