Network forensics: the art of catching digital criminals by examining the electronic evidence they leave behind. When a company's database is hacked, you cannot just ask the hacker to confess. Instead, you must look at the server logs to see who logged in, the network traffic to see what data was stolen, and the attack patterns to understand how the hacker broke in. For the 312-49 exam, you need to know exactly how to find that digital evidence and what it tells you.
Jump to a section
A simple way to picture Network Forensics: Logs, Traffic, and Attacks
A casino security manager, let's call her Maya, is responsible for the safety of a large casino floor filled with hundreds of gamblers, slot machines, and tables. She does not watch every single second of live video from the 200 cameras overhead — that would be impossible. Instead, she relies on two key things to catch cheaters and thieves. First, she reviews the casino's activity log, which is a huge digital spreadsheet recording every time a card was dealt, a chip was cashed in, or a door was opened. If someone reports a stolen wallet, Maya searches that log for unusual activity near the victim's table at the exact time of the theft. Second, she watches the actual security footage, the video replay, to see the event unfold frame by frame. She can see exactly who reached into the victim's bag. She also looks for patterns — maybe the same person visited three different tables and won big each time using the same trick. In network forensics, the activity log is the server log file, the security footage is the packet capture, and the cheater's pattern is a known attack signature. Maya's job is to find out what happened, who did it, and how to stop it from happening again, just like a forensic investigator does with network traffic.
The casino floor itself is the network. The gamblers are the users sending and receiving data. The stolen wallet is a data breach. The cheater's trick is an intrusion — someone breaking the rules using a specific technique. Maya's review of the logs and footage is not just looking for one incident; she is trying to piece together a narrative that explains the whole event. For example, she might notice that the log shows the floor manager's keycard was used to open a secure cash room at 3:00 AM, but the footage shows a different person swiping the card. The mismatch between the log and the video reveals a compromised credential — someone stole the manager's badge. This is exactly how network forensics uses logs and traffic captures to find criminals who have stolen user passwords.
Network forensics is the process of capturing, recording, and analysing network traffic to find out what happened during a security incident. Think about your home. You have a doorbell camera that records everyone who comes to the front door. If a package goes missing, you watch the recording to see who took it. Network forensics is exactly that, but for a company's computer network.
A computer network is a group of computers, servers, and devices that are all connected to each other so they can share information. Every time you send an email, visit a website, or log into a bank account, your computer sends little pieces of data called packets across this network. A packet is like a postcard — it has a from address, a to address, and a message. Most of the time, these postcards are harmless. But when a hacker attacks, they send malicious postcards designed to trick the system.
The most important part of network forensics is evidence collection. You cannot analyse what you do not have. In IT, this evidence comes in three main forms: logs, traffic captures, and attack signatures. - Logs are records that computers and software create automatically. Every time a user logs in, a file is accessed, or a program crashes, the system writes a line of text in a log file. Think of it like a diary that the computer writes for itself. Common log types include server logs (what happens on the web server), firewall logs (what traffic is allowed or blocked), and authentication logs (who logged in and when). - Traffic captures are recordings of the actual packets moving across the network. A forensic investigator uses tools like Wireshark to grab these packets and save them in a file called a packet capture or pcap. Later, they can open that file and see every single packet that passed through a network cable at a specific time. This is like recording a phone call so you can listen to it later. - Attack signatures are patterns that tell us something bad is happening. For example, if a hacker tries to guess a password by typing ten thousand different passwords in one minute, that creates a very specific pattern of traffic — lots of login attempts from the same computer in a short time. That pattern is an attack signature. Security systems like Intrusion Detection Systems (IDS) look for these signatures and raise an alarm.
Why does all this matter? Because networks are not physical spaces. You cannot see a hacker walking through the building. The only evidence you have is digital. When a company experiences a data breach where customer credit card numbers are stolen, the forensic investigator's job is to answer three questions: what happened, how did it happen, and who did it?
To answer the first question (what happened), the investigator looks at logs. For example, the database log might show that a file containing credit card numbers was copied to an external server at 3:14 AM on a Tuesday. The log shows the username of the person who copied it. But wait — the person whose username was used, Sarah from accounting, says she was asleep at that time. So the logs tell us what happened (the file was copied), but they do not tell us everything.
To answer the second question (how did it happen), the investigator examines the traffic captures. The pcap file from that time period will show the exact packets that were sent between the database server and the external server. The investigator discovers that the traffic used a protocol (a set of rules for communication) that is normally used for secure web browsing. That is suspicious — why is a database sending web traffic to an external server? The packet capture reveals the hacker used a technique called tunneling, where they hid the stolen data inside normal-looking web traffic to avoid detection.
To answer the third question (who did it), the investigator correlates the logs and the traffic captures. The login log shows that Sarah's account was accessed from an IP address in a foreign country at 3:10 AM. Sarah never travels there. The fireall log shows that the IP address in question had been scanning the company's network for weeks, looking for open doors. The traffic capture from that IP address shows the hacker used a specific tool to break into the server. By combining all this evidence, the investigator can prove that Sarah's account was compromised by a hacker.
Network forensics is not just about looking at one piece of evidence. It is about telling a story with multiple sources of evidence. Each log, each packet, and each attack signature is one piece of a puzzle. The investigator must fit them together to get the full picture. This is why the CHFI exam focuses so heavily on how to collect, preserve, and analyse these different forms of evidence.
Preserve the Evidence
Before analysing anything, you must secure the scene. Take forensic images of hard drives and copy all log files to write-protected media. This ensures the original evidence is not changed. In the 312-49 exam, this is the first principle of digital forensics.
Identify Relevant Log Sources
Determine which logs are most useful: web server logs, database logs, firewall logs, authentication logs, and system logs. Each gives a different perspective. For example, web server logs show what URLs were accessed, while authentication logs show who logged in.
Capture Live Network Traffic
Use a tool like Wireshark or tcpdump to capture packets on the network. Save the capture as a pcap file. This step is critical because network traffic is volatile — if you wait too long, the packets are gone forever.
Correlate Logs and Traffic
Match the timestamps from the logs with the timestamps in the pcap file. For instance, if a log shows a file was copied at 3:14 AM, find the packets from that exact time to see what data was sent where. This is how you confirm the story.
Analyse Attack Signatures
Look for known attack patterns in the traffic, such as repeated failed login attempts (brute force), unusual port scans, or SQL injection attempts. Tools like Snort or the built-in analysis in Wireshark can highlight these patterns automatically.
Document and Report
Write a detailed report that includes a timeline, the evidence found, and a conclusion about what happened and how. The report must be clear enough for non-technical managers and lawyers to understand. It will often be used in legal proceedings.
A mid-sized e-commerce company called ShopQuick noticed that customer payment data was being leaked to an unknown server. The IT team did not know how or when it started, but they knew it was happening because a security vendor alerted them. A certified forensic investigator was called in. Here is exactly what that investigator did, step by step.
First, the investigator secured the scene. In the digital world, securing the scene means preserving the evidence. The investigator took a forensic image of the web server's hard drive — that is a bit-by-bit copy, like making a perfect clone of a hard drive so no data is altered. They also copied all relevant log files to a write-protected external hard drive to prevent anyone from accidentally deleting them.
Second, the investigator identified the sources of logs that would be most helpful. They focused on three types:
The web server logs, which show every request made to the website, including IP addresses and timestamps.
The database server logs, which show who accessed the database and what queries they ran.
The fireall logs, which show all traffic entering and leaving the company's network.
Third, the investigator used a tool called Wireshark to capture live traffic on the network for 24 hours. This gave them a pcap file with hundreds of thousands of packets. They then used a technique called filter expression to narrow down the traffic to traffic going to the unknown server. This made the file manageable.
Fourth, the investigator analysed the web server logs. They found that a user with the username 'admin' had logged in from a strange IP address at 2:00 AM. The admin username belonged to the CEO, but the CEO was on vacation in Hawaii, and the IP address was from Eastern Europe. That was the first red flag. The log showed the 'admin' account had run a command to copy the customer database to a new folder.
Fifth, the investigator cross-referenced the timestamp from the web server log with the traffic capture. They opened the pcap file and filtered to show only the packets from the strange IP address around 2:00 AM. Inside that traffic, they discovered a file transfer using FTP (File Transfer Protocol, a way to send files over the internet). The file transferred was named customer_data_backup.zip. That matched the log entry.
Sixth, the investigator examined the attack signature. The traffic from the Eastern European IP address showed a pattern called brute-force login — multiple failed login attempts before the successful one. The hacker had tried hundreds of passwords on the 'admin' account until they found the correct one. The IDS had recorded this as a brute-force attack signature but nobody had investigated it.
Seventh, the investigator wrote a report detailing all the evidence: the compromised admin account, the brute-force attack pattern, the time of the data theft, and the destination server. They presented the evidence in a way that non-technical managers could understand, using a timeline chart showing exactly when each event occurred.
The company used this report to notify affected customers, strengthen their password policies, and block the Eastern European IP address at the fireall. The investigator had done their job. They had turned digital dust into a clear story of a crime.
The 312-49 exam tests Network Forensics in objective 6.1, and it is a heavy topic with many specific technical details you must memorise. The examiners love to test your understanding of the difference between logs, traffic captures, and attack signatures. If you confuse what a firewall log tells you versus what a packet capture tells you, you will get a question wrong.
What exact question types appear? You can expect multiple-choice questions that show you a short scenario (for example, 'an employee accessed a file at 3:00 PM, but the log shows a different username') and ask you which type of evidence is needed. The common trap is that the exam will list a single piece of evidence and ask 'what happened?', but the answer is often that you need two or more pieces of evidence together. For example, a question might say: 'You see a log entry showing a successful login. What can you conclude?' The trap answer is 'someone logged in successfully', but the correct answer is 'you cannot conclude anything without additional evidence, because the log could be tampered with.'
The examiners also love to test definitions. You must know these concepts cold:
Log: A record of events on a system. You must know that logs can be manipulated by attackers who have administrator access. The exam will test that logs alone are not reliable.
Packet capture (pcap): A recording of network traffic. You must know that pcap files can be huge and require filtering tools like Wireshark or tcpdump to analyse them.
Attack signature: A known pattern of malicious traffic. The exam will test the difference between signature-based detection (which finds known attacks) and anomaly-based detection (which finds strange behaviour even if it is not a known attack).
Protocol: A set of rules for communication. The exam expects you to know common protocols like HTTP (web traffic), FTP (file transfer), and DNS (domain name lookup).
IP address: A unique number assigned to every device on a network. Think of it like a mailing address.
Time stamp: The exact time an event was recorded. The exam often tests that timestamps on different systems might not match, so you need to synchronise them.
The exam also loves to ask about chain of custody. This is a legal principle that says you must prove that evidence has not been tampered with from the moment you collect it until you present it in court. For example, if you copy a log file, you must document who copied it, when, and with what tool. The exam will ask why chain of custody is important: the answer is 'to ensure the evidence is admissible in court.'
Finally, be ready for scenario-based questions about a specific attack called a Man-in-the-Middle (MitM) attack. This is where a hacker positions themselves between two computers and secretly captures all the data flowing between them. The exam will give you a scenario like 'a user complains their login credentials were stolen. Logs show no unusual logins. What do you check?' The correct answer is to examine traffic captures for evidence of an MitM attack, such as duplicate IP addresses or ARP poison packets.
Another common trap is the idea that fireall logs are the same as network logs. They are not. A fireall log only shows traffic that the fireall decides to permit or block. It does not show traffic that never reached the fireall. If a hacker connects directly to a server without passing through the fireall, the fireall log will show nothing. The exam will test this distinction.
Network forensics combines logs, traffic captures, and attack signatures to build a complete timeline of a security incident.
Logs are records of events on a system, but they can be tampered with by attackers who have administrative access.
Packet captures (pcaps) record every piece of data that moves across the network, but encrypted traffic remains unreadable without the decryption key.
Attack signatures are pre-defined patterns of malicious activity used by Intrusion Detection Systems to identify known threats.
Chain of custody is a legal requirement that every piece of digital evidence must be accounted for from collection to presentation in court.
A firewall log only shows traffic the firewall processed; it does not capture traffic that bypasses the firewall entirely.
Timestamps from different devices must be synchronised (e.g., using NTP) to create an accurate timeline during an investigation.
These come up on the exam all the time. Here's how to tell them apart.
Log File
Records events as text entries
Can be altered or deleted by admins
Shows summary of activity
Packet Capture (pcap)
Records raw network packets
Is a snapshot that cannot be easily edited
Shows every byte of data sent
Signature-based Detection
Looks for known attack patterns
Low false positive rate for known attacks
Cannot detect new or modified attacks
Anomaly-based Detection
Looks for unusual behaviour
Higher false positive rate
Can detect zero-day attacks
Firewall Log
Records permitted and blocked traffic
Focuses on network boundaries
Does not show internal application activity
System Log (e.g., Windows Event Log)
Records user logins, file access, and errors
Focuses on activities on a single machine
May show internal process behaviour
Unauthorised Access
Attacker gains direct login to a system
Shows as a log entry with a stolen credential
Evidence is in authentication logs
Man-in-the-Middle Attack
Attacker sits between two systems
May show no log entries on the target because data is intercepted en route
Evidence is in traffic captures showing duplicate IPs or ARP spoofing
Mistake
Logs always tell the complete truth about what happened on a system.
Correct
Logs can be deleted, altered, or overwritten by attackers who have administrative privileges. They are a starting point for investigation, but not infallible proof.
People trust computers to be objective, but an attacker who gains admin access can wipe or edit logs just like deleting a text file. Beginners assume logs are like video footage, but they are more like a whiteboard that can be erased.
Mistake
A packet capture contains every detail about a network communication, including the actual content of encrypted data.
Correct
A packet capture records the raw packets, but if the data is encrypted (like HTTPS traffic), the investigator cannot read the content without the decryption key. They can only see source, destination, and timestamps.
Movies and TV shows often show investigators 'decrypting' data instantly. In reality, encryption is very strong, and capturing the packet does not mean you can read the message.
Mistake
If a firewall log shows no suspicious activity, the network is secure.
Correct
A firewall log only shows traffic that the firewall sees. An attacker could bypass the firewall by connecting directly to a server through a different route, or by using a technique like SSL/TLS tunneling that makes malicious traffic look normal.
Beginners think of the firewall as an impenetrable wall, but it is more like a security guard at one door. The attacker might climb in through a window.
Mistake
Network forensics is only useful for catching hackers after a breach.
Correct
Network forensics is also used proactively to detect and stop ongoing attacks in real time, and to identify misconfigurations or policy violations before they lead to a breach.
The word 'forensics' sounds like you are investigating a crime after the fact. But many companies use network forensics tools continuously to monitor for suspicious behaviour as it happens.
Mistake
All attack signatures are 100% accurate and will catch every attack.
Correct
Attack signatures rely on known patterns, so new or modified attacks that do not match any existing signature will not be detected. This is called a zero-day attack. Anomaly-based detection helps but has higher false positives.
People think of antivirus software that catches everything, but network attack signatures are always a step behind the newest hackers. It is like having a wanted poster for a known criminal but not recognising a new one.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
You do not need to be a Wireshark expert, but the exam will expect you to know what a packet capture is, what a pcap file is, and how filters are used to narrow down traffic. You might be asked to interpret a simple filter string or identify a protocol in a mock capture.
No. Firewall logs are just one type of log used in network forensics. Network forensics is much broader and includes packet captures, system logs, and attack signatures. The firewall log tells you about traffic that was blocked or allowed, but not about traffic that never touched the firewall.
Yes. An attacker with administrative access can delete, modify, or overwrite log files. That is why forensic investigators take write-protected copies immediately. If a log seems too clean or perfect, that can also be a red flag that it was tampered with.
A log is a text record of events, like 'User admin logged in at 3:00 AM'. A packet capture is a recording of the actual data moving across the network, like a video of every action. Logs tell you what happened; packet captures show you the raw data that was transferred.
You need to know the most common ones: port 80 for HTTP, port 443 for HTTPS, port 21 for FTP, port 22 for SSH, and port 53 for DNS. The exam often uses port numbers in scenarios, so memorising these five will cover most questions.
An IDS is a system that monitors network traffic for suspicious activity and raises an alarm. It can be signature-based (looking for known patterns) or anomaly-based (looking for unusual behaviour). The exam will test your understanding of both types and their limitations.
You've finished Network Forensics: Logs, Traffic, and Attacks. Continue through the 312-49 study guide to build a complete picture of the exam.
Done with this chapter?