Network traffic as a source of evidence: Tool strengths, weaknesses, and future needs

Digital Investigation

Volumn 1, Issue 1, 2004, Pages 28-43

  Casey, Eoghan ^a  

^a Knowledge Solutions LLC   (United States)

Author keywords

Computer crime; Digital evidence; Forensic examination; Network investigations; Network traffic

Indexed keywords

COMPUTER NETWORKS; DATA ACQUISITION; DATA REDUCTION; LAWS AND LEGISLATION; NETWORK PROTOCOLS; SOCIETIES AND INSTITUTIONS; STANDARDS; TELECOMMUNICATION TRAFFIC; WEBSITES;

DIGITAL EVIDENCES; FORENSIC EXAMINATION; INTERNET RELAY CHAT (IRC) CHANNELS; NETWORK INVESTIGATIONS; NETWORK TRAFFIC;

COMPUTER CRIME;

EID: 3042852281     PISSN: 17422876     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.diin.2003.12.002     Document Type: Note

References (11)

1. Bellovin S.M., Blaze M., Farber D., Neumann P., Spafford E. Comments on the carnivore system technical review. http://www.crypto.com/papers/ carnivore_report_comments.html:2000;
2. Carrier B. Open source digital forensic tools: the legal argument. @stake Research Report http://www.cerias.purdue.edu/homes/carrier/forensics/docs/ opensrc_legal.pdf:2002;
3. Carrier B. Defining digital forensic examination and analysis tool using abstraction layers. Int J Digit Evid. 1:(4):2003;. Syracuse, NY, Available from: http://www.ijde.org/docs/02_winter_art2.pdf.
4. Casey E. Error, uncertainty and loss in digital evidence. Int J Digit Evid. 1:(2):2002;. Available from: http://www.ijde.org/archives/docs/ 02_summer_art1.pdf.
5. Casey E. Digital evidence and computer crime: forensic science, computers and the internet. 2nd ed. 2004;Academic Press.
6. Casey E., Palmer G. The investigative process. Digital evidence and computer crime: forensic science, computers and the internet. 2nd ed. 2004;Academic Press.
7. Cisco. Configuring the catalyst switched port analyzer (SPAN). Cisco Tech Notes http://www.cisco.com/warp/public/473/41.html:2003;
8. Corey V., Peterman C., Shearin S., Greenberg M.S., Van Bokkelen J. Network forensics analysis. IEEE Internet Comput. 6:(6):2002;. Available from: http://www.sandstorm.net/downloads/netintercept/ni-ieee.pdf.
9. Garfinkel S. Network forensics: tapping the internet. O'Reilly Network http://www.oreillynet.com/pub/a/network/2002/04/26/nettap.html.
10. IIT Research Institute. Draft report: independent technical review of the carnivore system. http://www.usdoj.gov:80/jmd/publications/carniv_entry.htm: 2000;
11. Venezia P. NetDetector captures intrusions. InfoWorld http://www.infoworld.com/article/03/07/11/27TCniksun_1.html?s=tc:July 2003;