Requirements

Investigations: The Wide Area Network

Introduction | The Internet—Backbone | The Internet—Information | Conclusion

Just as the Internet and wide area networks became the dominant form of computing over freestanding PCs and LANs, so did network forensics achieve prominence over desktop forensics. Most digital forensics investigations aren’t confined to a single system or even a single hard drive on a system. Today, most investigations will involve many different types of systems including personal computers, notebooks, servers, mainframes, mobile devices (phones and PDAs), and video and photo devices, to name a few. The standards-based and common communication protocol (TCP/IP) has made communications effortless for each device. The ubiquitous Internet has made the world much smaller and more accessible. Jurisdictional consideration is no longer at the county or state level, but now at the international level. Although each of these adds complexity to the investigation, communication is the common thread and a good understanding of it will certainly aid the investigator.

Introduction

Back to Top

This week, we will explore how networking, specifically the network (IP) and transport (UDP/TCP) layers, affect a digital forensic investigation. We will also consider the role of the Internet on an investigation and its multijurisdictional complexities. Each student must have a basic understanding of the TCP/IP protocol stack and its operation.

The Internet—Backbone

Back to Top

We often talk about the Internet, but rarely do we discuss it in sufficient detail to gain an understanding of how it actually works. At its most basic, the Internet is a collection of interconnected LANs to form wide area networks. To most people, and rightly so, it's a black box. It is usually sufficient to understand that to connect to the Internet, you get a connection with your local Internet Service Provider (ISP) such as Comcast, Verizon, or one of the thousands of other providers,...