Network Forensics: Tracking Hackers through Cyberspace

Chapter 2. Technical Fundamentals

“If you know the enemy and know yourself, you need not fear the results of a hundred battles.”

—Sun Tsu, The Art of War¹

The Internet ecosystem is varied and complex. In any network forensic investigation, there are an enormous number of places where evidence may live, some more accessible than others. Often, network-based evidence exists in places that local networking staff may not have considered, leaving it up to the investigator to review the network diagrams and make suggestions for evidence collection.

On the flip side, many networks are configured for functionality and performance, not for monitoring or auditing—and certainly not for forensic investigations. As a consequence, the specific instrumentation ...