Forensic Tools and Techniques
This domain tests tool selection and validation. You should know what each tool answers, its limits, and how to document reproducible analysis.
Core rules
Wireshark and tshark support deep protocol dissection and display filters; tcpdump is lightweight for capture and BPF filtering. Zeek produces connection, DNS, HTTP, and SSL logs for scalable triage. SiLK and flow tools analyze NetFlow, not payload. NetworkMiner extracts artifacts and hosts from PCAPs. Memory forensics tools examine RAM for connections and injected code; disk tools recover logs and artifacts. Use hashes and version numbers; validate with a second method where feasible.
Know the difference between capture filters (BPF, applied before capture, lossy if wrong) and display filters (applied after capture, nondestructive). Preserve the original file; export subsets for review.
Worked example
An analyst needs all TLS sessions from 10.0.4.17 to a suspect domain. In tshark, apply a display filter for ip.addr and tcp.port 443, then pivot on TLS handshake metadata and DNS answers. Save the filtered subset as a new file; never overwrite the original. Reasoning: filtering after capture preserves the full record and lets another examiner reproduce the subset.
Traps
Relying on default name resolution, which can alter displayed data; using a display filter as a capture filter; ignoring tool version differences; and failing to validate carved files. Also avoid claiming a tool’s output is conclusive without corroboration.