Digital Forensics for Network, Internet, and Cloud Computing

Chapter 7. NetWitness Investigator

Information in This Chapter

■NetWitness Investigator Architecture

■Import/Live Capture Network Traffic

■Collections

■Parsers, Feeds, and Rules

■Navigation Views

■Data Analysis

■Exporting Captured Data

Introduction

The ability to investigate a network-based crime presents a significant challenge to both the organization that experienced the crime and the network forensics examiner, who is responsible for conducting the analysis. Although many internal and external attacks occur across an organization's network, many organizations do not have in place network devices or tools that are able to conduct a network forensics investigation. In many environments, organizations are not able to capture network-based attacks, analyze ...