Network Forensics Investigation

This report is based on a series of practical investigations into a mock criminal case. The report dictates the technical findings and presents a theory for each part of the investigation. Each section of the report demonstrates an understanding of the relevant evidence collected and the tools and techniques used to recover that evidence from the network captures provided. The case briefs are provided below.

The case study provided:
You are working with a security agency on an international sporting competition corruption case. You have been asked to perform an investigation of the following network captures the agency has exfiltrated from parties of interest. You must supply the requested information and be verbose on how you recovered the evidence.

Capture 1.pcap:
Our intelligence has warned us of a suspected bribery in an international competition. Our suspect has downloaded files and we must know what these files contain. We need to know what files were sent, how you were able to recover them, and whether any of the files contain the potential names/aliases of actors in this case.

Capture 2.pcap:
IRC monitors have picked up encrypted traffic of a suspected corrupted officials speaking with a foreign national that goes by the alias of Ill-Song. Decode the conversations in this capture and provide a summary of where officials contacted by Ill-Song are located and whether the officials are innocent or guilty of corruption.

Capture 3.pcap:
We have picked up FTP traffic between a suspected corrupted official and a foreign national. Decode this traffic capture and provide us with evidence on what the corrupted official received. We suspect that some anti-forensic practices have been used to hide information sent—an Edward Snowden quote may help you decipher.

Capture 4.pcap:
We have uncovered communication traffic between Ill-Song and a known person of interest taking part in the international competition—Ann Dercover. We believe that they are trying to set up a meeting discreetly to avoid detection. We need to know details of the conversation that took place and the date and time that they are planning to meet.