Netflows as a source of forensic information

In his presentation Yann Berthier introduces Netflows as an information source for network forensics.

(more...)

By Andreas Schuster at 02/19/2006, 06:40 PM |

tcpxtract version 1.0

Tcpxtract is a carver for network traffic, which means it extracts files out of captured data. In order to determine start and end positions of a file it searches for certain byte sequences. This procedure was inspired by foremost, a carver for filesystem data.

(more...)

By Andreas Schuster at 10/13/2005, 05:35 PM |