eSecurity Institute

NetworkMiner

Network Miner is a Network Forensics Analysis Tool that is used to analyze packet captures and other valuable network data in an investigation. Network Miner functions as a passive network sniffer or packet capturing tool in order to detect operating systems, sessions, hostnames, open ports and more. Other features include

Autopsy: Digital Forensics

Autopsy is an open source digital forensics platform used by law enforcement, military, business and academic professionals. Autopsy is a feature rich platform that allows multiple add-ons for each specific industry. Autopsy comes equipped with the capability to allow the examiner to easily investigate computer hardware and mobile devices. Features

NirSoft Utilities

NirSoft is a website that offers free open source digital forensics and cybersecurity software. NirSoft utilities include a variety of free tools that can be helpful in a digital forensics investigation. The tools developed by NirSoft include capabilities that include password recovery, network protocol analyzers, command line utilities and web

Angry IP Scanner

The Angry IP Scanner is a free tool that operates on Windows, MacOS and Linux. The tool allows the user to easily scan IP addresses and ports along with other scanning features for network administration. The tool can conduct scans on local networks or over the internet. Users can scan

What is a Computer Forensics Investigator

A computer forensics investigator, also known as a computer forensics analyst is an individual who uses various advanced tools to extract, acquire, recover and analyze digital data and information found on technologies such as computers, mobile devices, smart technology and other stores of digital data. There are four main types

The Digital Forensics Process

Step 1: Identification The identification process is where the forensic investigator examines the available and potential sources for digital information. This could be hardware devices such as laptops, cellphones and tablets or it could be network data or information stored at the cloud. During the identification process the investigator highlights

Thumbcache Viewer

Thumbcache Viewer is a free tool that allows the user to extract thumbnail images associated with multimedia files on a computer. In many instances multimedia files that are deleted leave a trace of their contents through a thumbnail image. These thumbnail images can be recreated and easily extracted through the

Xplico: Network Forensic Analysis Tool

Xplico is an open source network forensics tool that differs from a network protocol analyzer. Xplico extracts the contents of various file types such as HTTP, IMAP, POP and SMTP. Xplico comes with a variety of powerful features such as data reassembly, realtime elaboration and Port Independent Protocol Identification (PIPI)

FTK Imager

FTK Imager is a digital forensics tool developed by Exterro. FTK Imager is a tool used for creating forensic images when examining multiple types of drives, devices and external memory sources. Creating a forensic image of a drive is an essential process in digital forensics. This allows investigators to examine

WireShark

WireShark is a free and open source network protocol analyzer. WireShark is used worldwide by a variety of security professionals in government, law enforcement, business and academia. WireShark is considered by many as the standard for network forensics tools on the market. WireShark has a rich set of features and

SIFT Workstation

The SIFT Workstation is a collection of digital forensic tools developed by SANS Institute. The SIFT Workstation not only provides access to digital forensic tools but also several tools used for incident response which may also be required in forensic roles. The SIFT Workstation is capable of reading and examining

OS Forensics

OS Forensics is an organization that develops free and paid digital forensics tools. OS Forensics offers four tools which can be downloaded for free on their website. The four tools are 1) OSF Mount, 2) OSF Clone, 3) Volatility Workbench and 4) Image USB. OSF Mount allows the user to

X-Ways: WinHex

WinHex is a hexadecimal editor which is used for a variety of data recovery and digital forensic tasks. WinHex works with CD's, floppy disks, DVD's, Zip files, Flash files and other multimedia files. WinHex also works with RAID systems and a variety of other dynamic file systems on the market.

IPv6 Transition

As illustrated in the previous section there is a shortage of IPv4 addresses available to the public. Because of this depletion of available addresses as well as other considerations it is important that organizations begin to transition to the updated IPv6. In addition to practically unlimited address space IPv6 offers

IPv4 and IPv6 Differences

Internet protocol version 4 (IPv4) is one of the most commonly used protocols and serves as an internationally recognized standard using for the internet. It was developed in the United States in the 1980’s by the Defense Advanced Research Project (DARPA). IPv4 allows for the formation of a system

IPv6 Artifacts

IPv6 artifacts are pieces of digital evidence that can be collected and analyzed in the process of IPv6 forensics. These artifacts can take many forms, including network logs, system logs, cached data, and other types of digital evidence. One common type of IPv6 artifact is network logs, which can provide

IPv6 Forensics

IPv6 forensics is the process of collecting, analyzing, and interpreting digital evidence from Internet Protocol version 6 (IPv6) networks and devices. This type of digital forensics is necessary because IPv6 is increasingly being used as the primary protocol for internet communication, and it is important for forensic investigators to be

IPv4 and IPv6

IPv4 Internet Protocol version 4 or IPv4 is the standard IP address used since the early 80’s. IPv4 is a 32 bit address that looks like this (192.168.154.130). There are three parts of an IPv4 address which identify the network, host and subnet number. While IPv4

The OSI Model

The Open Systems Interconnection Model or OSI Model is logical structure for understanding computer networking designed by the International Organization for Standardization (ISO). The OSI Model is separated into 7 layers which are 1) Physical Layer, 2) Data Link Layer, 3) Network Layer, 4) Transport Layer, 5) Session Layer, 6)

Quality of Service in Computer Networking

QoS is an essential element of network architecture that is commonly used at the enterprise level. In environments where certain network functions can’t afford to be delayed or interrupted QoS should be implemented. A well designed plan with with QoS should increase the performance and efficiency of a network

What is the Cyber Domain?

The cyber domain as it is referred to in the reading materials, is essentially a combination of space, various threat actors and competing agendas. The cyber domain is like any other war fighting domain such as sea, air or land. Each of these domains includes a variety of assets, liabilities,

An Evaluation of Digital Forensics Tools

Introduction This report covers five digital forensics software tools that vary in user difficulty from the beginner to intermediate level. These five tools cover various aspects of digital forensics to include memory analysis, mobile forensics, network forensics, decryption and various other aspects and functions. The five tools listed in this

What is a Cyber Act of War?

U.S. Legal defines an act of war with the following description. “An act of war is an action by one country against another with an intention to provoke a war or an action that occurs during a declared war or armed conflict between military forces of any origin. The

U.S. Law and Cybersecurity

The U.S. government began to take cybersecurity more seriously over the last two decades as numerous cyber attacks and incidents have occurred highlighting the vulnerabilities that were present. As decision makers have slowly learned about the threats to national security that cyber attacks present they have updated their viewpoints

Featured

What is Digital Forensics?

Digital forensics is an element of cybersecurity that focuses on the acquisition, recovery, investigation and analysis of digital material found on electronic devices, computer networks, cloud resources and mobile devices. Digital forensics is commonly used by law enforcement in the investigation of cyber crimes as well as non-cyber related criminal