Advanced Digital Forensic Investigations unit 1 DB, Essay Example

The astounding thing today is there shear amount of data moving. We have gone from 10mbps to 1gbps in a matter of a few years, which has necessitated the movement from fixed hardware storage to virtual storage in the form of a cloud. Log files which list actions in text form are saved on the Operating System (OS) e.g. Web servers history of page requests as well as bandwidth usage. This is very important for forensic investigation.

Combine with packet analyzers or sniffers allows investigators to view port numbers, Time and IP address which helps in threat identification, origin and analysis. Packets analyses by using packet capture uses the historical data to help investigators know how many systems where affected, from where and when. Further more Deep Packet Inspection will provide forensic analysis to uncover the primary cause of the network problems, ensure data communications and identify security threats. A packet is analyzed when data streams are analyzed either in part or whole by decoding the raw data and looking for pre-configured and pre-determined attack signatures and statistical or algorithmic anomalies. Three parts of a network packet are header chunk and payload.

The structure of a log file differ from operation system to operating system in windows NT has an event logging service, Windows event logging is based on HTML technology. It has a small file header followed by a series of chunks.

Regulators under the (CALEA) Communications Assistance for Law Enforcement Act sort to improve the capabilities of law enforcement agencies fight crimes such as terrorism, pedophilia and cyber crime.

References

Lunt, Teresa F., “IDES: An Intelligent System for Detecting Intruders,” Proceedings of the Symposium on Computer Security; Threats, and Countermeasures; Rome, Italy, November 22–23, 1990,

Kevin J. Connolly Law of Internet Security and Privacy. (2003). Aspen Publishers.

Erik Hjelmvik (2008). “Passive Network Security Analysis with NetworkMiner”. Forensic Focus. Retrieved 2011-10-o4