CHFI (312-49) Digital Forensics Simulation

Investigation Scenario

You are responding to a suspected data exfiltration incident at a defense contractor in Northern Virginia. The internal SOC detected anomalous outbound traffic to an unknown offshore IP address over the weekend.

Full packet capture (PCAP) was not enabled on the core switch due to high storage constraints. However, NetFlow v9 logging is active and currently forwarded to the central SIEM. You need to analyze the available network artifacts to determine the scope of the potential exfiltration.

Evidence Collected (Network Artifacts)

Question

During a network-forensics investigation in Northern Virginia, an analyst is analyzing NetFlow data to identify patterns of suspicious network activity. Which of the following information is typically included in a NetFlow record?

Expert Analysis

1. What the evidence shows

The collected evidence is a NetFlow v9 record showing a high-volume data transfer (approx 6.8 MB contained in 4,592 packets) occurring over TCP port 443 (HTTPS) from an internal HR workstation to an external IP address.

2. Identify forensic stage

This scenario resides in the Examination & Analysis phase of the Digital Forensics Process, specifically focusing on Network Forensics.

3. Why correct answer is correct

A. Source and destination IP addresses, ports, protocol, and the number of bytes and packets: This is correct because NetFlow is specifically designed to collect IP traffic statistics and connection metadata. It operates at Layers 3 and 4 of the OSI model. Standard fields always include Src/Dst IP, Src/Dst Port, Protocol, TCP Flags, Bytes, and Packets.

4. Why others are wrong

• B. The full payload of the network packets: NetFlow explicitly strips payloads to reduce storage and processing overhead on networking equipment.
• C. The names of the files being transferred: File names reside in the application layer (Layer 7). Because NetFlow lacks payload data, it cannot parse file names from protocols like SMB or FTP.
• D. The user's login credentials: Credentials also reside within the application-layer payload. Extracting these requires Full Packet Capture (PCAP).

5. Real-world forensic action

Because the investigator only has NetFlow, they cannot see what was exfiltrated, only how much (6.8 MB). The investigator will use this metadata to determine the exact timeline of the unauthorized connection. Next, they will cross-reference the internal IP (192.168.10.45) with DHCP and Active Directory authentication logs to identify the compromised machine and user account. Finally, they will pivot to host-based forensics, acquiring an image of the HR workstation to look for staging directories or browser history matching the timeframe.

6. MINI LESSON: Network Evidence Types