Network Forensics – Investigation and Traceability of Network Threats

Training objective: Develop the skills necessary to integrate network evidence into forensic investigations, reconstruct attacker actions, extract evidentiary elements from network captures (PCAP, NetFlow, proxy, SSL), analyze protocols, detect suspicious behaviors, and automate large-scale analysis.

• Collect, filter, and interpret network data for forensic purposes
• Reconstruct attacks from captures and network logs
• Extract files and identify suspicious behaviors from PCAP data
• Use NetFlow data to investigate over time
• Decrypt and analyze TLS exchanges within a legal framework
• Automate network analysis using open-source tools or scripts
• Conduct a comprehensive network investigation in hybrid environments