Enumerating the Network Infrastructure as a Forensics Analyst

Network forensics is the investigation of network traffic patterns and data captured in transit between computing devices. Network forensics can provide insight into the source and extent of an attack. It also can supplement investigations focused on information left behind on computer hard drives following an attack.

You should be familiar with the basic concepts of the OSI and TCP/IP models and some of the key networking protocols and devices in use on a modern network and be involved or interested in first response, incident handling, and digital forensics.

A network protocol is an established set of rules that determine how data is transmitted between different devices in the same network. Essentially, it allows connected devices to communicate with each other, regardless of any differences in their internal processes, structure or design. The network device is one kind of device used to connect devices or computers together to transfer resources or files like fax machines or printers. Examples of network devices include switch, hub, bridge, router, gateway, modem, repeater & access point.

The Internet works by using a protocol called TCP/IP, or Transmission Control Protocol/Internet Protocol. TCP/IP is the underlying communication language of the Internet. In base terms, TCP/IP allows one computer to talk to another computer via the Internet through compiling packets of data and sending them to right location.

A digital forensic investigator backtracks the footprints of the lawbreaker to extract digital artifacts. These pieces of evidence then help in retrieving useful data to support the legal proceedings. Usually, digital artifacts consist of computer files, hard drives, emails, images, and other storage devices.