Title: 3. Developing Standard Procedures for Network Forensics
Course: IN 2005 Digital Forensics > Section: Module 11: Chapter 11 - Virtual Machines, Network Forensics, and Live Acquisitions

Developing Standard Procedures for Network Forensics

1. Network forensics is a long, tedious process.
2. The standard procedure for network forensics as follows:
  - Always use a standard installation image for systems on a network
  - Close any way in after an attack
  - Attempt to retrieve all volatile data
  - Acquire all compromised drives
  - Compare files on the forensic image to the original installation image
3. To illustrate the differences between computer forensics and network forensics.  As a network forensic investigator, you need to work on an isolated system to prevent affecting other parts of your network.

Reviewing Network Logs

1. Logs record all traffic leaving and entering your network. You can use logs from the following network components during an investigation:
  - Network servers
  - Routers
  - Firewalls
2. Tcpdump is a common tool for analyzing network traffic.
3. Analyzing traffic includes:
  - Creating top 10 lists
  - Looking for patterns to understand the attack
  - Determine if other companies are involved on the attack
4. If other companies are involved in the attack, you must proceed as in a computer forensic investigation.  You shouldn’t reveal information discovered about other companies.  In these situations, the best course of action is to contact the companies and enlist their aid in tracking down network intruders.