Network Forensics Overview

qive the questions and anwers for the following topics for 5-6 marks
Introduction to Network Forensics, Network Components and their forensic importance, OSI
internet Layers and their Forensic importance, Tools Introduction Wireshark and TCPDUMP,
Wireshark Packet Analyzer,Data acquisition- understanding storage formats and digital evidence,
determining the best acquisition method, acquisition tools, validating data acquisitions, remote
network acquisition tools. Processing crimes and incident scenes, securing a computer incident or
crime, gaining digital evidence at scene, maintaining digital evidence, obtaining digital hash,
reviewing case.

Got it👍 — I’ll give you exam-ready 5–6 mark answers (structured, crisp, easy to memorize). No
unnecessary fluff, just what you can write directly.

🔹 1. Introduction to Network Forensics

Answer:

Network Forensics is a branch of digital forensics that focuses on monitoring, capturing, and
analyzing network traffic to detect and investigate cyber crimes.

Key Points:

It involves packet capture, analysis, and reconstruction of events.

Helps identify:

Unauthorized access
Malware communication
Data breaches

Works in real-time (live analysis) and post-incident analysis.

Objectives:

Identify attacker behavior

Trace source and destination of attack

Preserve evidence for legal purposes

Conclusion:

Network forensics plays a critical role in cybersecurity investigations and incident response.

🔹 2. Network Components and Their Forensic Importance

Printed using ChatGPT to PDF, powered by PDFCrowd HTML to PDF API. 1/14
Answer:

Component Forensic Importance

Router Stores logs of traffic, IP routes, attack paths

Switch MAC address table helps identify devices

Firewall Logs blocked/allowed traffic

IDS/IPS Detects suspicious activities

Servers Contains application logs and user activity

End Devices Source of attack or victim system

Key Points:

Logs are primary evidence

Helps reconstruct network activity timeline

Identifies entry and exit points of attacks

🔹 3. OSI & Internet Layers and Their Forensic Importance

Answer:

OSI Layers (Forensics Role):

1. Physical Layer – Cable tampering, hardware issues

2. Data Link Layer – MAC address tracking

3. Network Layer – IP address tracing (most important)

4. Transport Layer – Port numbers, TCP/UDP analysis

5. Session Layer – Session hijacking detection

6. Presentation Layer – Encryption/encoding analysis

7. Application Layer – Logs (HTTP, FTP, DNS)

Internet Model (Simplified):

Application
Transport

Internet

Network Access

Importance:

Helps investigators analyze attacks layer-by-layer

Identifies where attack occurred

Printed using ChatGPT to PDF, powered by PDFCrowd HTML to PDF API. 2/14
🔹 4. Tools: Wireshark and TCPDump
Answer:

Wireshark:

GUI-based packet analyzer

Captures and displays packets in detail

Supports filters for analysis

TCPDump:

Command-line packet capture tool

Lightweight and used in servers

Captures packets in .pcap format

Difference:

Feature Wireshark TCPDump

Interface GUI CLI

Usage Detailed analysis Quick capture

Complexity Easy Moderate

Conclusion:

Both tools are essential for network traffic monitoring and forensic analysis.

🔹 5. Wireshark Packet Analyzer

Answer:

Wireshark is a powerful tool used to capture, inspect, and analyze network packets.

Features:

Real-time packet capture

Deep inspection of protocols
Filtering (e.g., [Link] == x.x.x.x)

Color-coded packets

Uses:

Printed using ChatGPT to PDF, powered by PDFCrowd HTML to PDF API. 3/14
 Detect malicious traffic

Analyze protocols
Troubleshoot network issues

Example:

Detect suspicious HTTP requests

Identify malware communication

🔹 6. Data Acquisition in Digital Forensics

Answer:

Data acquisition is the process of collecting digital evidence from devices.

Storage Formats:

Raw format (.dd)

E01 (EnCase format)

AFF (Advanced Forensic Format)

Acquisition Methods:

Static (Dead) – system powered off

Live – system running

Tools:

FTK Imager
EnCase

dd command

Importance:

Ensures data integrity and admissibility in court

🔹 7. Determining Best Acquisition Method

Answer:

Selection depends on:

Factors:

System state (on/off)

Printed using ChatGPT to PDF, powered by PDFCrowd HTML to PDF API. 4/14
 Type of data (volatile/non-volatile)

Urgency of investigation

Methods:

Live acquisition → RAM, running processes

Dead acquisition → disk imaging

Conclusion:

Correct method ensures maximum evidence preservation.

🔹 8. Validating Data Acquisitions

Answer:

Validation ensures that the acquired data is unchanged and authentic.

Methods:

Hashing (MD5, SHA-1, SHA-256)

Compare original and acquired hash values

Process:

1. Calculate hash before acquisition

2. Calculate hash after acquisition

3. Compare both

Importance:

Maintains evidence integrity

Accepted in court

🔹 9. Remote Network Acquisition Tools

Answer:

Used to collect data from remote systems over a network.

Examples:

Netcat

FTK Imager (remote mode)

EnCase Enterprise

Printed using ChatGPT to PDF, powered by PDFCrowd HTML to PDF API. 5/14
Features:

Remote evidence collection

Secure data transfer

Useful in distributed systems

Risk:

Data alteration during transfer

🔹 10. Processing Crimes and Incident Scenes

Answer:

Steps involved in handling cybercrime scenes:

Steps:

1. Identify incident

2. Secure the area

3. Collect evidence

4. Document everything

5. Preserve data

Importance:

Prevents evidence tampering

Maintains investigation accuracy

🔹 11. Securing a Computer Incident Scene

Answer:

Steps:

Isolate system from network

Prevent unauthorized access

Do not power off immediately (if live evidence needed)

Document system status

Goal:

Preserve volatile and non-volatile data

Printed using ChatGPT to PDF, powered by PDFCrowd HTML to PDF API. 6/14
🔹 12. Gaining Digital Evidence at Scene
Answer:

Sources:

Hard disks

RAM
Logs

USB devices

Actions:

Capture volatile data first

Create disk image

Maintain chain of custody

🔹 13. Maintaining Digital Evidence

Answer:

Key Practices:

Use write blockers

Store in secure location

Maintain logs of access

Follow chain of custody

Importance:

Ensures evidence is legally valid

🔹 14. Obtaining Digital Hash

Answer:

Hash is a unique fingerprint of data.

Algorithms:

MD5

SHA-1

SHA-256

Printed using ChatGPT to PDF, powered by PDFCrowd HTML to PDF API. 7/14
Use:

Verify integrity

Detect tampering

🔹 15. Reviewing Case

Answer:

Final step in investigation.

Steps:

Analyze collected evidence

Correlate events

Prepare report

Present findings

Goal:

Provide clear and accurate conclusions

🔥 Quick Tip for Exam:

If stuck → write:

Definition

3–4 points
Example

Conclusion

If you want, I can:

✅ Convert this into 1-page revision notes
✅ Give important questions (most expected)
✅ Or make short mnemonics for fast memorization

Introduction to Web Attacks , Website Copier: HTTRACK , Site Report Generation: Netcraft ,
Vulnerability Analysis: Nikto , Deep Information Gathering Tool: Dmitry , Image Metadata
Extraction using Imago, Introduction to Password Cracking, Password Cracking using Rainbow
Tables.
Case study- PDF File Analysis, Remote Imaging using E3 Digital Forensics.

Printed using ChatGPT to PDF, powered by PDFCrowd HTML to PDF API. 8/14
Got it 👍 — continuing in the same exam-ready 5–6 marks format (structured, easy to memorize,
direct writing style).

🔹 1. Introduction to Web Attacks

Answer:

Web attacks are malicious activities targeting web applications, servers, or users to steal data, disrupt
services, or gain unauthorized access.

Common Types:

SQL Injection (SQLi) – manipulating database queries

Cross-Site Scripting (XSS) – injecting malicious scripts

Cross-Site Request Forgery (CSRF)

File Inclusion Attacks (LFI/RFI)

Objectives:

Data theft
Website defacement

Unauthorized access

Conclusion:

Web attacks exploit vulnerabilities in web applications and must be prevented using secure coding and
monitoring.

🔹 2. Website Copier: HTTrack

Answer:

HTTrack is a tool used to download entire websites for offline browsing.

Features:

Copies HTML, images, and files

Maintains website structure

Works recursively

Forensic Importance:

Preserves website content as evidence

Helps analyze compromised websites

Printed using ChatGPT to PDF, powered by PDFCrowd HTML to PDF API. 9/14
Example:

Investigating a phishing website

🔹 3. Site Report Generation: Netcraft

Answer:

Netcraft is an online tool used to gather information about websites.

Provides:

Hosting provider details

Server technology

IP address and uptime

Security reports

Forensic Importance:

Helps identify server location and ownership

Useful in tracking malicious websites

🔹 4. Vulnerability Analysis: Nikto

Answer:

Nikto is an open-source tool used to scan web servers for vulnerabilities.

Features:

Detects outdated software

Finds misconfigurations
Identifies security issues

Output:

Detailed vulnerability report

Use:

Pre-attack security testing

Incident investigation

🔹 5. Deep Information Gathering Tool: Dmitry

Printed using ChatGPT to PDF, powered by PDFCrowd HTML to PDF API. 10/14
Answer:

Dmitry (Deepmagic Information Gathering Tool) is used for collecting information about domains and
hosts.

Functions:

WHOIS lookup

Subdomain search

Email address harvesting

Port scanning

Importance:

Helps in reconnaissance phase

Identifies potential targets

🔹 6. Image Metadata Extraction using Imago

Answer:

Imago is a tool used to extract metadata from images.

Metadata Includes:

Date and time

Camera details

GPS location

Forensic Importance:

Identifies source of image

Tracks location and device

Example:

Finding location of a crime scene image

🔹 7. Introduction to Password Cracking

Answer:

Password cracking is the process of recovering passwords from stored or transmitted data.

Methods:

Printed using ChatGPT to PDF, powered by PDFCrowd HTML to PDF API. 11/14
 Brute Force Attack
Dictionary Attack
Hybrid Attack

Purpose:

Security testing

Recover forgotten passwords

Cyber attacks

🔹 8. Password Cracking using Rainbow Tables

Answer:

Rainbow tables are precomputed tables of hash values used to crack passwords quickly.

Working:

1. Passwords are hashed

2. Hash is matched with table

3. Original password is retrieved

Advantages:

Faster than brute force

Disadvantages:

Requires large storage

Ineffective with salted hashes

🔹 9. Case Study: PDF File Analysis

Answer:

PDF analysis involves examining PDF files for hidden malicious content or metadata.

Steps:

1. Extract metadata
2. Check embedded scripts

3. Analyze suspicious links

4. Scan for malware

Printed using ChatGPT to PDF, powered by PDFCrowd HTML to PDF API. 12/14
Tools:

PDFiD
PDF-parser

Importance:

Detect phishing PDFs

Identify malware payloads

🔹 10. Remote Imaging using E3 Digital Forensics

Answer:

E3 (Electronic Evidence Examiner) is a tool used for remote acquisition of digital evidence.

Features:

Remote disk imaging

Live system acquisition

Supports multiple devices

Advantages:

No physical access required

Saves time in investigation

Use:

Corporate investigations

Cybercrime cases

🔥 Quick Revision Trick (Very Important)

If short on time, remember this flow:
👉 Recon → Scan → Analyze → Crack → Report
Dmitry → Info gathering
Netcraft → Site details
Nikto → Vulnerability scan

HTTrack → Copy website

Imago → Metadata
Rainbow tables → Password cracking

Printed using ChatGPT to PDF, powered by PDFCrowd HTML to PDF API. 13/14
💡 If you want next level prep:
I can:
✅ Give most expected exam questions (IMP list)
✅ Create 1-page cheat sheet (revision before exam)
✅ Or take a rapid viva test (you answer, I check)

Printed using ChatGPT to PDF, powered by PDFCrowd HTML to PDF API. 14/14