Working in investigative teams, students will use forensic analysis tools to build a coherent picture of the crime. We will investigate by carving files out of raw network traffic, and extracting sensitive data hidden in ICMP payloads. We will trace the attack to its source by correlating activity with firewall logs, central server logs, IDS logs, and other network-based evidence. Finally, we will identify one of our suspects by reconstructing cached Web content, analyzing DHCP logs, and implementing passive OS fingerprinting techniques.

After using this evidence to build a solid case, we will develop a cohesive picture of the crime and discuss techniques for presenting supporting evidence in deposition.