CSD1001 | Module 5 – Network Forensics | Exam Preparation

CSD1001 – Principles of Digital Forensics

MODULE 5: NETWORK FORENSICS
Exam Questions with Model Answers | VIT Bhopal University

Q24. Justify the network protocols regarding email tracing and internet fraud.
Distinguish in which layer of OSI, attacks can happen and highlight its vulnerability.
Part A: Network Protocols in Email Tracing
Email travels through a chain of servers and protocols. Forensic investigators trace emails by
analysing these protocols and the header information embedded at each hop.
➤ SMTP (Simple Mail Transfer Protocol): Port 25/587. Used to send/relay emails. Headers
added at each relay show originating IP, timestamps, and server names — key for tracing sender
identity.
➤ POP3 / IMAP: Used to receive emails. IMAP (Port 143) keeps mail on server (important for
evidence preservation); POP3 (Port 110) downloads and deletes — evidence may be lost.
➤ DNS (Domain Name System): MX records identify mail servers. SPF, DKIM and DMARC
records help verify whether an email domain is spoofed or legitimate.
➤ TCP/IP: Provides the underlying transport. IP packets carry source/destination addresses
traceable through ISP logs and NAT tables.
Part B: Internet Fraud Investigation via Protocols
➤ Phishing / Spoofing: Attackers forge 'From' headers using open SMTP relays. Investigators
check Received: headers (added by each server) to trace the actual originating IP.
➤ Key Header Fields: Received, X-Originating-IP, Message-ID, Date — each provides forensic
clues about the real source.
➤ Log Correlation: SMTP server logs, firewall logs, and ISP DHCP records are combined to map
an IP address to a real-world subscriber.
Part C: OSI Layer Attacks & Vulnerabilities
➤ Layer 7 – Application: SQL Injection, XSS, Phishing, Malware downloads. Vulnerability: lack of
input validation, weak authentication.
➤ Layer 6 – Presentation: SSL stripping attacks, data format exploits. Vulnerability: weak
encryption (deprecated SSL/TLS versions).
➤ Layer 5 – Session: Session hijacking, cookie theft. Vulnerability: predictable session IDs, no
session timeout.
➤ Layer 4 – Transport: SYN Flood (DDoS), port scanning. Vulnerability: TCP three-way
handshake exploitation.
➤ Layer 3 – Network: IP Spoofing, ICMP attacks, routing attacks. Vulnerability: no inherent
authentication of IP source.
➤ Layer 2 – Data Link: ARP Spoofing, MAC flooding, VLAN hopping. Vulnerability: ARP has no
authentication mechanism.
➤ Layer 1 – Physical: Cable tapping, hardware keyloggers, jamming. Vulnerability: physical
access to medium.
Most critical layers: Layer 3 (Network) and Layer 7 (Application) are most targeted. Firewalls,
IDS/IPS, and protocol hardening address these vulnerabilities.

Q25. Demonstrate how to configure the router, investigate the logs and formulate its
loophole.
Part A: Router Configuration Basics
Router configuration is the first step in securing a network and enabling forensic-ready log collection.
➤ Access the Router: Connect via console cable (serial) or via SSH/Telnet to the management
IP. Use CLI (Cisco IOS) or web GUI.

VIT Bhopal University | Page 1 of 5

 CSD1001 | Module 5 – Network Forensics | Exam Preparation
➤ Enable Logging: Command: logging on | logging buffered 16384 | service timestamps log
datetime msec — logs timestamped events locally.
➤ Syslog to Remote Server: logging host <SIEM-IP> — sends logs to a centralised Security
Information and Event Management server for preservation.
➤ Enable NetFlow: ip flow-export destination <IP> 2055 — captures traffic statistics (source/dest
IP, ports, bytes) useful for forensic reconstruction.
➤ Access Control Lists (ACL): Apply inbound and outbound ACLs to permit/deny traffic. Logs
permit/deny events with timestamps and IPs.
➤ Enable SNMP: Allows remote monitoring; configure read-only community strings. Use SNMPv3
with authentication for security.
Part B: Investigating Router Logs
➤ System Logs: Review for login attempts, interface up/down events, and configuration changes.
Timestamp + source IP + event code form the forensic chain.
➤ Authentication Logs: Multiple failed SSH/Telnet login attempts = brute force. Document
originating IP, time, and frequency.
➤ Traffic Anomalies: Unusual data spikes, unexpected external connections, or new routing table
entries indicate intrusion or data exfiltration.
➤ Running Config Comparison: Compare current running-config to a known-good baseline.
Unauthorised changes to routing protocols, NAT, or ACLs are red flags.
Part C: Common Router Loopholes
➤ Default Credentials: Many routers ship with 'admin/admin'. Attackers use this to gain full
control. Fix: always change default passwords immediately.
➤ Telnet (Unencrypted): Telnet transmits credentials in plaintext — sniffable on LAN. Fix: disable
Telnet, use SSH v2 only.
➤ Unrestricted Management Access: Router management interface accessible from any IP. Fix:
restrict access using ACL — permit only the management VLAN.
➤ SNMP v1/v2 Community Strings: Transmitted in plaintext. Fix: use SNMPv3 with authPriv
mode.
➤ No Logging / Short Buffers: Evidence is lost when buffers overwrite. Fix: send logs to external
Syslog/SIEM server in real-time.
➤ Firmware Vulnerabilities: Outdated IOS/firmware has known CVEs. Fix: regularly apply vendor
security patches.

Q26. Demonstrate in detail about the mobile forensics techniques and tools.
Definition
Mobile forensics is the science of recovering digital evidence from mobile devices — smartphones,
tablets, GPS units — in a forensically sound manner that preserves data integrity and chain of
custody.
Key Challenges in Mobile Forensics
➤ Device Diversity: Thousands of models, OS versions (Android, iOS, HarmonyOS). Each has
different acquisition methods.
➤ Encryption: Full-disk encryption (FDE) and file-based encryption (FBE) block direct data access
without credentials.
➤ Remote Wipe: Devices can be remotely wiped via Find My iPhone or Google Device Manager.
Solution: enable Airplane Mode immediately after seizure.
➤ Anti-Forensic Techniques: Encrypted messaging apps (Signal), self-destructing data, third-
party vault apps.
Mobile Forensics Acquisition Techniques
➤ 1. Manual Extraction: Examiner navigates the device UI and photographs/screenshots
evidence. Least invasive but limited in depth.
➤ 2. Logical Acquisition: Connects device via USB. Extracts files, contacts, call logs, messages
via OS backup APIs (iTunes, ADB). Fast but incomplete.
VIT Bhopal University | Page 2 of 5
 CSD1001 | Module 5 – Network Forensics | Exam Preparation
➤ 3. File System Acquisition: Accesses the entire file system including app data and deleted
files. Requires device to be jailbroken/rooted.
➤ 4. Physical Acquisition: Bit-by-bit copy of the entire memory chip (NAND flash). Most complete
— recovers deleted files. Requires specialised hardware (JTAG, Chip-Off).
➤ 5. JTAG / ISP: Direct interface with the device circuit board via debugging ports. Bypasses OS-
level locks. Used for locked/damaged devices.
➤ 6. Chip-Off: Physically removes the memory chip and reads it with a reader. Last resort —
destructive but yields complete data image.
Key Mobile Forensics Tools
➤ Cellebrite UFED: Industry-standard tool. Supports 20,000+ devices. Performs physical, logical,
and cloud extraction. Generates court-admissible reports.
➤ Oxygen Forensic Detective: Extracts data from mobile devices, cloud accounts, drones, and
IoT. Supports 40,000+ apps.
➤ Magnet AXIOM: Analyses both mobile and computer data. Cloud acquisition support (Google,
Apple, Microsoft). Excellent timeline and artifact reconstruction.
➤ ADB (Android Debug Bridge): Free CLI tool for Android. Used for logical extraction and app
data backup.
➤ iMazing / iTunes: Logical backup extraction for iOS devices.
➤ Autopsy: Open-source forensics platform with mobile modules. Analyses Android images.
Evidence Collected from Mobile Devices
➤ Communication: SMS, MMS, call logs, WhatsApp/Telegram chats, emails.
➤ Location Data: GPS coordinates, cell tower logs, Wi-Fi connection history, Google Timeline.
➤ Media: Photos (with EXIF metadata — date, GPS, device model), videos, audio recordings.
➤ App Data: Social media, banking apps, browser history, search history, deleted chat recovery.

Q27. Evaluate the scenario where mobile forensics techniques and its tools are used
to find the Intrusion Detection method and mention the uses of Pegasus software.
Scenario Setup
A government official's phone shows signs of compromise: battery draining fast, unexplained data
usage, microphone activation with no active calls. The forensic team is tasked with determining
whether the device was breached and by what method.
Step 1 – Device Seizure and Preservation
➤ Isolation: Place the device in a Faraday bag immediately to block all wireless signals and
prevent remote wiping or command-and-control (C2) communication.
➤ Power: Keep device powered on (powered-off devices may have encryption keys erased from
RAM). Document state.
➤ Document: Photograph the device, note battery level, open apps, network connections before
touching anything.
Step 2 – Acquisition
➤ Tool Used: Cellebrite UFED Physical Analyzer — performs full physical extraction to capture
memory, deleted data, and app artefacts.
➤ iOS Specific: If device is jailbroken, use full file system extraction. Otherwise use logical
extraction + iCloud backup analysis.
➤ Android: ADB + root access for file system image. Use Magnet AXIOM to parse the resulting
image.
Step 3 – Intrusion Detection Analysis
➤ Suspicious Processes: Analyse running processes and background services. Pegasus creates
hidden processes with randomised names. Tools: checkra1n, MVT (Mobile Verification Toolkit)
by Amnesty International.
➤ Network Traffic Analysis: Review connection logs — unexplained connections to known
Pegasus C2 IPs/domains. Compare with threat intelligence feeds.

VIT Bhopal University | Page 3 of 5

 CSD1001 | Module 5 – Network Forensics | Exam Preparation
➤ Battery and Data Usage Logs: Excessive usage by unknown apps during idle periods is a
strong indicator of spyware activity.
➤ File System Anomalies: Presence of unusual dylibs (.so files), modified system files, or hidden
data partitions.
About Pegasus Spyware
Pegasus is a zero-click, state-sponsored surveillance spyware developed by NSO Group (Israel). It
requires NO user interaction — the target device is compromised simply by receiving a specially
crafted iMessage, WhatsApp call, or SMS.
➤ Capabilities: Full access to: microphone, camera, GPS, messages, encrypted communications
(Signal, WhatsApp), email, call recording, and keystrokes.
➤ Zero-Day Exploits: Uses previously unknown vulnerabilities in iOS/Android to gain kernel-level
privileges.
➤ Detection Tool: Amnesty International's MVT (Mobile Verification Toolkit) — open-source CLI
tool that scans iOS backups and Android images for Pegasus indicators of compromise (IOCs).
➤ Forensic Indicators: [Link] database anomalies, crash logs for exploited processes,
unexpected process database entries, and suspicious domain lookups in DNS cache.
➤ Documented Use: Identified on devices of journalists, activists, government officials globally
(Pegasus Project, 2021 investigation by Forbidden Stories and Amnesty Tech).

Q28. List out open-source security tools for network forensic analysis and explain
them briefly.
Introduction
Network forensics involves capturing, recording, and analysing network traffic and events to identify
security incidents, reconstruct attacks, and gather evidence. Open-source tools provide powerful
capabilities used by professionals worldwide.
➤ 1. Wireshark: The most widely used network protocol analyser. Captures live traffic and
displays it in a human-readable format. Supports 3000+ protocols. Used to reconstruct sessions,
detect ARP poisoning, analyse malware C2 traffic. Filters using display filters (e.g., [Link],
[Link] == x.x.x.x).
➤ 2. Tcpdump: Lightweight CLI-based packet capture tool. Ideal for capturing traffic on remote
servers where no GUI is available. Output can be saved as .pcap files for later Wireshark
analysis. Fast, low overhead, scriptable.
➤ 3. NetworkMiner: Passive network forensics tool and sniffer. Reconstructs files, images, emails,
and web pages transmitted over the network from pcap files. Identifies OS, hostname, and
sessions without sending a single packet.
➤ 4. Snort: Open-source Intrusion Detection and Prevention System (IDS/IPS). Uses rule-based
detection to alert on malicious traffic patterns (port scans, exploit attempts, C2 beacons).
Generates alerts that form the basis of forensic investigation.
➤ 5. Zeek (formerly Bro): Powerful network analysis framework. Generates rich, structured logs
([Link], [Link], [Link], [Link]) from captured traffic. Used for threat hunting and anomaly
detection. Scripts can detect complex multi-stage attacks.
➤ 6. Suricata: High-performance IDS/IPS/NSM engine. Multi-threaded (unlike Snort single-
thread). Supports Snort rules, Lua scripting, and JA3/JA3S TLS fingerprinting. Generates EVE
JSON logs consumable by SIEM tools.
➤ 7. Nmap: Network mapper and port scanner. Used in forensics to reconstruct the network
topology at the time of incident. Identifies live hosts, open ports, services, and OS versions. Can
replay known scan patterns to compare with IDS logs.
➤ 8. Autopsy / Sleuth Kit: Open-source digital forensics platform. While primarily for disk
analysis, it integrates network evidence artefacts — browser history, cached files, email — found
on examined systems.
➤ 9. NetFlow Analyser (nfdump/nfcap): Collects and analyses Cisco NetFlow/IPFIX data from
routers/switches. Reconstructs 'who talked to whom, when, and how much data was transferred'
— vital for network forensics timelines.

VIT Bhopal University | Page 4 of 5

 CSD1001 | Module 5 – Network Forensics | Exam Preparation
➤ 10. OSSEC: Host-based Intrusion Detection System (HIDS). Monitors system logs, file integrity,
rootkit detection. In network forensics, correlates host events with network events to build a
complete attack picture.
How These Tools Work Together (Forensic Workflow)
➤ Step 1 – Capture: Tcpdump / Wireshark capture raw traffic at the network boundary.
➤ Step 2 – Detect: Snort / Suricata / Zeek analyse captured traffic and generate alerts and
structured logs.
➤ Step 3 – Investigate: NetworkMiner reconstructs sessions; nfdump analyses flow data; Nmap
rebuilds topology.
➤ Step 4 – Report: Findings compiled into court-admissible forensic reports with timestamps,
packet captures as exhibits, and chain of custody documentation.

QUICK MEMORY AID – Module 5 Key Topics

➤ Q24: Protocols: SMTP (email trace) | OSI Layers: App(7)→Physical(1) | Most attacked: L3 & L7
➤ Q25: Router Forensics: Enable logging → Syslog to SIEM → Check ACL changes → Fix: no
Telnet, patch firmware
➤ Q26: Mobile Techniques: Manual→Logical→FileSystem→Physical→JTAG→ChipOff | Tools:
Cellebrite, AXIOM, Oxygen
➤ Q27: Intrusion: Faraday bag → Cellebrite → MVT for Pegasus | Pegasus = zero-click spyware,
NSO Group
➤ Q28: Tools: Wireshark(capture), Snort(IDS), Zeek(logs), Suricata(IPS),
NetworkMiner(reconstruct), Nmap(topology)

VIT Bhopal University | Page 5 of 5