Network, Internet and Email Evidence
Network, Internet and Email Evidence
This domain tests network logs, browser artifacts, and email headers. The exam stresses attribution limits: an IP address is not a person.
Core rules
- Network sources include firewall, proxy, IDS/IPS, NetFlow, DHCP, DNS, NAT, VPN, and packet capture. Record retention, time zone, and log source reliability.
- IP attribution requires NAT and DHCP lease mapping plus subscriber records. Do not equate an IP with an individual; cloud and mobile NAT complicate attribution.
- Browser artifacts include History and Cookies (SQLite), cache, Local Storage, IndexedDB, downloads, and sync data. Private browsing may leave limited traces.
- Email evidence includes Received headers, Message-ID, Return-Path, SPF/DKIM/DMARC results, server logs, PST/OST/MBOX files, and attachments. Read Received chains from bottom to top; display names and Date headers are easily forged.
Worked example
A phishing email shows a trusted display name but fails SPF. The examiner reads the Received chain upward, identifies the originating cloud IP, correlates it with firewall and mail-gateway logs, and preserves full headers. The conclusion addresses delivery and infrastructure, not the human sender without further evidence.
Traps
Treating an IP as identity; ignoring NAT and DHCP lease times; trusting the email Date header; analyzing a forwarded message without full headers; mismatching time zones across logs.
Key points
- IP addresses require NAT, DHCP, and subscriber correlation.
- Browser SQLite databases hold history, cookies, and downloads.
- Email headers must be preserved in full and read bottom-up.
- SPF, DKIM, and DMARC support authentication, not authorship.
- Time-zone normalization is essential across network logs.