Almost every modern incident involves the network: an attacker connects in, moves around, and sends data out. Network forensics is the practice of capturing and analysing that traffic, along with the logs and metadata around it, to reconstruct what happened and who was involved.
You'll start with packet captures (PCAPs) and learn to read them in Wireshark using filters and statistics. Then you'll analyse a malicious capture to spot suspicious traffic, and see how Zeek turns raw traffic into searchable logs. You'll also learn how full packet data, transaction logs, and flow records each answer different questions during an investigation.
Next up is Mobile & Cloud Forensics, where evidence lives on phones and in services you don't physically control.
How to analyse network traffic and packets in a digital forensics investigation to find possible malicious activity.
How to capture packets with Wireshark and analyse the traffic sent to and from the devices on your network.
A walkthrough of analysing a malicious PCAP file, which is captured network traffic, to understand what happened on the network.
An explanation of the four types of network security monitoring data, including full packet content (PCAP) and transaction logs, and what each one is good for.