A Model Based Approach for the Extraction of Network Forensic Artifacts

Forensic analysts typically search through a large volume of data in different locations looking for possible evidences. The process can be very tedious and time consuming. Automating the process of searching for possible evidences can be very useful even if this can be as an initial stage before further deep human or manual analysis. Toward this goal, we developed a tool to automate extracting forensic artifacts from network resources. We evaluated the tool using artifacts of network packets and switch memory dumps. We found out that their is a need to balance between customization and level of details or accuracy that such tools can produce. This means that it will be impractical to develop a one-for-all tool or else such tool will be very large, complex and possible inefficient.