November 23, 2009, 3:09 PM — Computer forensics don't have to solely focus on recovering and searching for evidence on storage devices. Although programs like Encase and FTK 3.0 are excellent tools to help find documents, photographs and other files for your investigation, they cut short on collecting network traffic your suspect sends and receives.
Viewing stored URL visits and local cache only paint a limited picture of the suspect's Internet usage and sometimes amount to the same as reading tea leaves. A document opened online, an incriminating instant message or even a VOIP call can and should be forensically captured and reviewed for your investigations.
See also: How to Build Your Own Digital Forensics Lab for Cheap
Below are four free or low-cost options to monitor your target's network connection, capture forensic traffic and review the data for evidence. Consult with your company's legal and IT departments before monitoring Internet connections. This may be illegal in some areas or against company policy.
Before getting started you have to decide which of the four monitoring options best work for your investigation. Each option has its own unique function that works for different scenarios that are rated below based on Level of Expertise to setup it up, Covert Application (risk of getting caught) and Network Type (wireless vs. LAN):
See also: What to Bring on a Computer Forensics Investigation
1. SPAN port monitoring. Level of Expertise: 1 of 5, Covert: 3 of 5, Network: LAN and WLAN.
Monitoring this way is probably the easiest to do and best option for the corporate environment. Although your target will have no clue he or she is being monitored, you need to trust your IT department because they will need to plug a computer into the SPAN port.
No additional tools are needed other than an extra Ethernet cable and your computer. And because the system is monitoring near the end point of the system, Wi-Fi traffic of your suspect can be captured as it leaves the network and returns. Your IT department will know what a SPAN port is and how to do this. It is a very common procedure for uses other than monitoring.
Tools to Identify Anonymous Users Online
2. Hub router. Level of Expertise: 2 of 5, Covert: 3 of 5, Network: LAN only.
Without getting too technical, a hub router (not a switched router, which is common at most stores) is an easy and effective way to split the suspect's network so you see a mirror image of their traffic. These routers can be ordered online for $30, but your IT department probably has a few extra lying around. Simply connect the hub between the suspect's wall port or in the network room and into your computer to start monitoring. As long as you hide the hub and third Ethernet cable this can be very covert and easy to do without even tipping off IT.
An Investigator's Toolkit: 5 Free Tools to Send Anonymous Messages
3. AirpCap card. Level of Expertise: 3 of 5, Covert: 5 of 5, Network: WLAN only.
I'm placing this option on here for more of an educational purpose. In the corporate setup the SPAN port will be your best setup for monitoring Wi-Fi connections but you never know. The AirpCard is a USB-based tool that works much like a police scanner. Instead of receiving police traffic it can capture and view network traffic traveling between the target's laptop and the Wi-Fi router.
5 Free Ways to Track Online Leaks of Information
This tool is very useful in TSCM, penetration testing and other not-so-legal exploits, making hackers in love with it. Another negative is its price. It will cost you about $350.
4. ARP poisoning. Level of Expertise: 5 of 5, Covert: 3 of 5, Network: LAN and WLAN.
ARP poisoning is a handy exploit that allows you to confuse a LAN- or WLAN-networked computer connected on your network into believing you are the router and letting you capture the target's data as it passes through your computer to the real router.
This is often called a man-in-the-middle attack and is often used by hackers at coffee shops to steal your information. Although this can be fairly easy to set up without IT support, there is a chance of crashing your corporate network if done wrong. If you are willing to take the risk head over to www.oxid.it and down the powerful program "Cain and Abel."
There are plenty of short YouTube videos that can get you running in minutes.
