Digital forensic analysis through Firewall for detection of information crimes in hospital networks

Abstract

Digital forensics analysis was done by taking a view of Firewall on the Firewall used in the hospitals, and the data that could create a criminal element were determined. As is known, all network traffic on the networks is over the firewall. For this reason, the traffic on the entire network is recorded on the firewall. When these records need to be analyzed in terms of forensic information and criminal elements should be detected, the records on the firewall should be analyzed without deterioration. For this purpose, the image of the firewall needs to be taken. However, in order to obtain images, it is necessary to calculate MD5 and SHA-1 HASH values with international validity, which confirm the integrity of the image. For this purpose, the Juniper SSG 550 firewall device used in Firat University Hospital will be analyzed. For analysis, FTK Imager program which is developed by AccessData firm and offered for free use will be used. This image will be analyzed with forensic tools such as forensics explorer.