Forensic Carving of Network Packets and Associated Data Structures
Using validated carving techniques, the authors show that popular operating systems (e.g. Windows, Linux, and OSX) frequently have residual IP packets, Ethernet frames, and associated data structures present in system memory from long-terminated network traffic. Such information is useful for many forensic purposes including establishment of prior connection activity and services used; identification of other systems present on the system's LAN or WLAN; geo-location of the host computer system; and cross-drive analysis. They show that network structures can also be recovered from memory that is persisted onto a mass storage medium during the course of system swapping or hibernation.