We'll begin with covert ICMP and DNS tunnels. You'll extract tunneled TCP and IP packets from DNS NULL records and use active evidence collection methods to uncover the rogue system administrator's secret plot!

By the afternoon, we'll conduct hands-on active evidence acquisition. You'll inspect router ARP tables and firewall logs. Volatility and collection methods vary depending on configuration, manufacturer, and the environment. We'll also cover ways that investigators can compensate for less-than-ideal network environments, using publicly available forensic evidence acquisition tools.