View source for Forensic Examination of Packet Captures

The following scenarios are sourced from well known Network Forensic challenges. All of the techniques used to answer these questions should have been demonstrated in [[Network Forensics with Wireshark]].

== Scenario 1 ==

Investigate the following network packet capture and try to answer the following questions. 

*What is the user interested in? (Hint: DNS)
*What is the colour of the little mermaid's hair? (Hint: Recover HTTP Objects)

Click [[Media:AllPlayNoWork.pcap.zip|here]] to download the zipped .pcap file to examine

== Scenario 2 ==

Ann works for your food company. It is suspected that she is a mole and is working for a competing company. Ann has access to the secret recipe, which is the company’s prize asset. Security staff are worried that Ann may leak the company’s secret recipe. Today a new laptop appeared on the company network and the network engineers captured it and submitted it to you for analysis. As the forensic investigator, your mission is to figure out who Ann is communicating with and work out what happened.

Questions to answer:
*Who is Ann talking to?
*What protocol and application are they using to communicate?
*What is the secret recipe and how was it leaked?
*What is Ann's IP address?
*What is Ann's MAC address and what vendor built her PC?

Click [[Media:Forensics.zip|here]] to download the zipped .pcap file to examine

== Scenario 3 ==

Ann has organised to meet up with a shady figure, known as Dark Tangent. You are a forensic investigator. Can you figure out their destination? Click [[Media:evidence.pcap.zip|here]] to download the file to examine.


 <!--This puzzle was run at DEFCON 2010. 221 teams of experts played. The winners worked solved it in 5 hours. Even with the answers, you will not solve this puzzle in the tutorial.

Answers: http://forensicscontest.com/2011/07/31/puzzle-7-answers

This puzzle was sourced from are from http://forensicscontest.com/. Permission was sought and granted to use them in teaching at Murdoch University. -->