Handbook of Digital Forensics and Investigation

Chapter 9. Network Investigations

Eoghan Casey, Christopher Daywalt, Andy Johnston and Terrance Maguire

Contents

Introduction437

Overview of Enterprise Networks439

Overview of Protocols442

⁸A 502 HTTP response code does not necessarily mean that the request failed. The requestor may have obtained some information.

Evidence Preservation on Networks457

Collecting and Interpreting Network Device Configuration458

Forensic Examination of Network Traffic479

Network Log Correlation— A Technical Perspective505

Conclusion516

References516

Introduction

Tracking down computer criminals generally requires digital investigators to follow the cybertrail between the crime scene and the offender's computer. The cybertrail can cross multiple networks and geographical ...