DFIR – Netwerk

Wireshark 101 | Traffic Analysis and Investigation (PART 04)

This entry is part 18 of 18 in the series Incident Response and Forensics

Views: 3Encrypted Protocol Analysis: Decrypting HTTPS When investigating web traffic, analysts often run across encrypted traffic. This is caused by using the Hypertext Transfer Protocol Secure (HTTPS) protocol for enhanced security against spoofing, sniffing and intercepting attacks. HTTPS uses TLS protocol to encrypt communications, so it is impossible to decrypt the traffic and view the … Read more

Concepts of Forensic Imaging

by Bharath Narayanasamy

This entry is part 1 of 2 in the series Digital Forensics and Incident Response

Views: 7Core Concepts The process of imaging a disk starts by identifying the target drive, preparing it for imaging, and then creating the image file which is later verified for integrity. This needs to be performed in an environment that allows us to perform these tasks and also ensures the process is properly logged. Each … Read more

Incident Response

by Bharath Narayanasamy

This entry is part 12 of 2 in the series Digital Forensics and Incident Response

Views: 1Incident response, also known as incident handling, is a cyber security function that uses various methodologies, tools and techniques to detect and manage adversarial attacks while minimizing impact, recovery time and total operating costs. Addressing attacks requires containing malware infections, identifying and remediating vulnerabilities, as well as sourcing, managing, and deploying technical and non-technical … Read more