Download - Foreign Military Studies Office - U.S. Army

contain evidence are mail servers, which could contain not only email but also
attachments to the email, and the email logs. The site may keep web server logs
that would show which websites a user may have visited. The network or
domain servers may show login data, file download data, application usage,
privilege levels, directory permissions, and a multitude of other data that may
be useful in an investigation. Security testing records may show the
configuration of a user’s workstation that may be helpful in certain types of
investigations.
Besides the computers on the network, other network devices may
contain useful information. These devices include firewalls which may have
some useful data in the firewall logs, border or intranet segregating routers
which may have data in router logs, intrusion detection systems, web servers,
DNS servers, and so on. Any of these devices, logs, or information may help in
an investigation to determine what happened, when it happened, how it
happened, and to or by whom. Network forensics is time consuming and
usually requires the assistance of the network administrator or expert help.
Since, in most cases, a court is not going to give law enforcement permission to
seize a whole network, it usually requires that a search be completed on-site.
This increases the possibility of missing valuable information. Usually the
search has to be completed within a time limit, and that means that law
enforcement has little time to respond to a configuration or system that is not
familiar to them. Much preparation is required to conduct a network search.
Law enforcement officials can help themselves by gathering data that helps
determine configurations such as operating system types, hardware issues,
storage issues, application issues, and so on. If an investigator knows he is
going to have to search a local area network with one file server running an NT
server with ten workstations running Windows 98 and that the application most
likely to have the data they are seeking is Microsoft Access, then he should
prepare for this eventuality. He must insure he has the capability on hand to
search the network.
There are many methods to uncover data from a remote access, or to
change or acquire data. The system logs may be the best starting place. If data
were changed, older versions of the file should then be compared. Some files
are stored temporarily, and these may also be a source for comparison. If this
system were part of a network, file servers may store backups of these files.
Again, a file comparison can be used. All network access devices have the
capability to store audit or login logs, and these may be very useful in
determining the source of a remote entry into a system.
325