Network Forensics
Network forensics typically refers to the specific analysis of computer network traffic (Internet/Ethernet) that traces out internet security attacks or other types of cybercrimes in order to gather information, legal evidence for litigation purposes, or detection of intrusion. The major areas of these cybercrimes are hacking, data theft, corporate espionage, defamation, software piracy, online harassment or discrimination, obscene publications, spousal disputes, credit card cloning, identity theft, company policy violations, cyber-stalking, etc.
The growth in network connectivity within homes and businesses has resulted in an increase in cyber-crimes. Data is now available outside of a disk. Situated in the virtual world, this presents special difficulties, as the digital framework is significantly larger.
Our definitive goal
To probe until we find the information you need, and in some cases to provide you with the necessary evidence for a successful prosecution.
Our network forensics experts have several main areas of operations:
Hackers: The first is to monitor a network for irregular traffic and to identify security intrusions. A cyber invader might be capable of deleting all log files of a exposed host. Possibly, the only attainable evidence for analysis is network based. This is mainly in the business sector and sometimes in the personal sector.
Business: The second involves monitoring communications within the work place. In some cases monitoring a problematic employee or partner, and in others, searching for evidence of corporate espionage.
Personal: The third use is for compiling information by searching network communications. This is more often used for personal reasons, such as accessing online files of a deceased individual, or in cases of spousal disputes/suspicious activities.
Criminal: The fourth use of network forensics can relate to the area of law enforcement. Analysis of ascertained network traffic may include searching for keywords, reassembling files, and exploring communication, such as emails or chats.
Our forensic experts investigate to identify unauthorized access to a computer system, then compile the evidence through collection, normalizing, filtering, labeling, stream reassembly, correlation and analysis of multiple sources of traffic data. The methods we use are:
– Intrusion detection
– Logging vast records of a network
– Correlating intrusion detection and logging
Challenges
Unlike computer forensics, where evidence is preserved on a disk, network data is very unstable and unpredictable. Investigators may only be able to examine existing materials if intrusion detection systems and firewalls were set up in anticipation of security breaches.
The first challenge in organizing a network forensics investigation is the vast amount of data produced by the network per day. Searching for evidence is very tedious and the more time passes, the more difficult this process becomes. The second challenge is the Internet’s capability to engulf the cyber attacker in a cloud of anonymity. Each network layer uses addressing such IP addresses, MAC addresses and of course e-mail addresses, all of which can be faked. We have developed, over years of experience, a range of powerful forensic analysis software, allowing us to successfully solve these cases.
