A detailed search of the Web site has been conducted, and no files were found beyond the static HTML Web pages expected. Three workstations are used to update content on the Web site, and a network packet trace has been captured for traffic between the workstations and the internal FTP upload site for posting data to the Web server. This packet trace is available for your use.
Once you understand the situation, your manager tells you to divide the investigation into three parts. The first part involves the use of NetWitness Investigator to identify user credentials, correlate source host address(s), and evaluate network traffic for unusual activity that might provide a starting point for your system forensic investigation.
In the second part, you will use Paraben P2 Commander to examine a forensic system image and evaluate files, communications, and applications, which could be items of potential evidentiary value in this investigation. You will use your findings from the first part of the investigation to guide your selection of workstation(s) for review and user profile(s) for specific investigation.
In the third part, you need to document your results along with the investigative process and any indicators you discovered that led to additional actions on your part. The investigation must be limited to the scope identified by these indicators, and all investigative actions should be supportable if you are called as an expert witness in later proceedings.
AAA Computer Forensics has been contracted by Corporation Techs to investigate a potential data breach at their location. They have provided a packet trace for analysis, which will be ran through NetWitness Investigator to attempt to determine if there is in fact a breach. The first thing we will do is use the import feature to bring the packet capture into the software. At this point we can open the session