Forensic Carving of Network Packets and Associated Data Structures
Abstract
Using validated carving techniques, we show that popular operating systems (e.g.
Windows, Linux, and OSX) frequently have residual IP packets, Ethernet frames, and
associated data structures present in system memory from long-terminated network
traffic. Such information is useful for many forensic purposes including establishment of
prior connection activity and services used; identification of other systems present on the
systemà à ¢ s LAN or WLAN; geolocation of the host computer system; and cross-drive analysis.
We show that network structures can also be recovered from memory that is persisted
onto a mass storage medium during the course of system swapping or hibernation. We
present our network carving techniques, algorithms and tools, and validate these against
both purpose-built memory images and a readily available forensic corpora. These techniques
are valuable to both forensics tasks, particularly in analyzing mobile devices, and to
cyber-security objectives such as malware analysis.
Description
DFRWS 2011, Aug. 1-3, 2011, New Orleans, LA. BEST PaperR AWARD
The article of record as published may be found at http://dx.doi.org/10.1016/j.diin.2011.05.010
Refereed Conference Paper
Rights
This publication is a work of the U.S. Government as defined in Title 17, United States Code, Section 101. Copyright protection is not available for this work in the United States.Collections
Related items
Showing items related by title, author, creator and subject.
-
Active Control of Adaptive Optics System in a Large Segmented Mirror Telescope
Nagashima, M.; Agrawal, B.N. (2012);For a large Adaptive Optics (AO) system such as a large Segmented Mirror Telescope (SMT), it is often difficult, although not impossible, to directly apply common Multi-Input Multi-Output (MIMO) controller design methods ... -
Spin stabilization of the ORION satellite using a thruster attitude control system with optimal control considerations
Cunningham, Janet L. (Naval Postgraduate School, 1989);The controlled system is the ORION satellite spinning about its single axis of symmetry. Hydrazine thrusters are used as the control and are modeled by ideal, constant magnitude step functions. The system is normalized and ... -
Acquisition and Development Programs through the Lens of System Complexity
Pugliese, Antonio; Enos, James; Nilchiani, Roshanak (Monterey, California. Naval Postgraduate School, 2018-04-30); SYM-AM-18-165The approach of the Department of Defense (DoD) to acquisition programs is strongly based on systems engineering. DoD Directive 5000.01 calls for "the application of a systems engineering approach that optimizes total ...