Download - Foreign Military Studies Office - U.S. Army

Network Monitoring
Some data as we have mentioned before is volatile. Some data such as
the commands a hacker might issue from a remote location will be lost if the
investigator does not capture the activity in progress. The stored digital data
may show the result, but what transpired and how it was done may best be
answered using a network monitoring program. There are many types of
network monitoring programs such as commercial, shareware, and freeware for
different types of operating systems. There are even post processing programs
that interpret the captured data back into a playback session which can show
what the hacker typed, how fast he typed it, and even his spelling mistakes. The
network monitoring program used by the FBI is Carnivore or FBI DCS 1000—
an intercept program that captures network traffic and has post processors that
tie the packets back into network sessions, such as Simple Mail Transfer
Protocols (SMTP, sometimes called port 25 traffic) back to an email session.
3. Link Analysis
With so many kinds of data to analyze in a networking case, it may be
useful to use some tools to view and grasp the whole picture of what transpired
on a network and the locations that data has traversed. These tools assist in that
type of analysis:
1. Starlight—a form of link analysis using Extensible Markup Language
(XML) tags so that different types of records can be compared to one
another, such as the comparison of phone records to computer logs.
2. Spire—a visual analysis program that searches text-based files for
correlation of data. This includes log files, email, and IRC logs.
3. Intrusion Detection Systems (IDS)—located on networks that have
been attacked. Data from the IDS can include transaction logs of the
attacker’s activity that may include the source of the attack. It may
contain content data that will help investigators determine the type of
attack.
There are many difficulties in investigating a cybercrime whether it be
digital forensics or network forensics. The examples above demonstrate a few
that law enforcement officials face. Because of these difficulties, other
traditional law enforcement methods may need to be employed. These include
nontechnical means, such as physical surveillance, online sources, sting
operations, and criminal intelligence.
Receiving a Complaint about a Cybercrime
How does a cybercrime come to the attention of law enforcement
officials? Sometimes it is because law enforcement officials take the initiative
and educate corporations on cybercrime prevention. In the United States, the
326