The Case for Teaching Network Protocols to Computer Forensics Examiners

Gary C. Kessler
Champlain College
Center for Digital Investigation
Burlington, Vermont
gary.kessler@champlain.edu

Matt Fasulo
U.S. Secret Service
Burlington, Vermont
matt.fasulo@usss.dhs.gov

ABSTRACT

Most computer forensics experts are well-versed in basic computer hardware technology, operating systems, common software applications, and computer forensics tools. And while many have rudimentary knowledge about the Internet and simple network-lookup tools, they are not trained in the analysis of network communication protocols and the use of packet sniffers. This paper describes digital forensics applications for network analysis and includes four case studies.

Keywords: computer forensics education, network forensics, protocol analysis