Category "Network forensics"

In his presentation Yann Berthier introduces Netflows as an information source for network forensics.

Tcpxtract is a carver for network traffic, which means it extracts files out of captured data. In order to determine start and end positions of a file it searches for certain byte sequences. This procedure was inspired by foremost, a carver for filesystem data.