Network Forensics and Data Acquisition

What it is

Data acquisition is the process of making a forensically sound copy of digital evidence so that analysis is done on the copy, never on the original. It is the most important technical step in an investigation, because mistakes here cannot be undone.

This page also covers where web and network evidence comes from, the two timings of analysis, and the service model that outsources forensic work.

How it works

Web applications and network forensics

Web application forensics examines web server, application and database logs, session data and uploaded files to reconstruct an attack. Network forensics captures and analyzes traffic and device logs to see what moved across the network.

Postmortem and real time analysis

Postmortem analysis studies stored evidence after the event, such as saved logs, disk images and packet captures. Real time analysis observes activity while it is happening, for example live traffic monitoring or a running system. Real time work can catch an attack in progress but risks altering the system, while postmortem work is safer for the evidence but depends on what was already recorded.

Forensics as a service (FaaS)

FaaS is a cloud style service in which a provider supplies forensic tools, storage and expertise on demand. It is useful for organizations that lack a lab, for cloud evidence and for scaling during large cases. Concerns are trust in the provider, chain of custody, data location and legal jurisdiction, and confidentiality, so the contract should address them.

Data acquisition: live and dead

Live acquisition captures memory, network connections and running processes that disappear at shutdown, but the act of collecting alters the system slightly, so every action must be recorded. Dead acquisition preserves the disk using a write blocker and is more repeatable.

Order of volatility

Collect the most volatile evidence first, because it is lost soonest. The order from RFC 3227 is:

1. CPU registers and cache.
2. Routing table, ARP cache, process table, kernel statistics and memory.
3. Temporary file systems.
4. Disk.
5. Remote logging and monitoring data.
6. Physical configuration and network topology.
7. Archival media.

Rules of thumb for data acquisition

• Never work on the original evidence. Work on a verified copy.
• Use a hardware or software write blocker so the source cannot change.
• Use forensically clean (sanitized) destination media.
• Make at least two copies, one to analyze and one kept untouched.
• Calculate hashes of the source and the image, and confirm they match.
• Collect in order of volatility.
• Label evidence and maintain the chain of custody.

An example of the hash check on a Linux examination system:

sha256sum evidence.dd

The output is a 64 hexadecimal character digest. It is compared with the digest taken from the source at acquisition. If they match, the image is an exact copy.

Types of data acquisition

A bit stream copy includes deleted files, slack space and unallocated space, which a logical copy does not.

Determine the data acquisition format

Choose the format based on tool support, storage space and the need for metadata and integrity features.

A worked example

An investigator arrives at a powered on workstation that uses full disk encryption.

The investigator photographs the screen, captures RAM first, then network state, then makes a bit stream image of the decrypted logical volume while the system is running, and finally verifies the hash. A dead acquisition alone would have left only encrypted data.

How the exam asks about this

• "Which evidence should be collected first?" → The most volatile, such as CPU registers, cache and memory.
• "Which acquisition type includes deleted data and slack space?" → A bit stream copy.
• "What confirms that an image is identical to the source?" → Matching hash values.