Important Information from Routers during an Investigation
Most attacks require forensic analysts to look for information in the router. Therefore, analysts need to have knowledge about the router architecture. Routers are either hardware or software devices that route data from a local network to other networks. The devices decide on the path that internet traffic flows. Routers have become the target for attackers since once hacked, the router gives the hacker full control of a network. Most router attacks focus on configuration errors, and weak passwords. Although targeted, is often assumed that routers cannot give evidenced to analysts during an investigation. This is because it is almost impossible to acquire volatile data from a router. In most cases, the current configuration is considered as volatile information, and it is stored in the Random Access Memory. If the router is powered down or the configuration is erased, volatile data in the router is lost; therefore, no essential crime information can be obtained.
However, routers can give critical information during an investigation. Routers can help in a live analysis based on their functional value, which is to receive, read headers, calculate the optimal address for forwarding, and forward data packets (McMIllan, 2011). Since network forensics focuses on monitoring and live acquisition of data packets, they can use router information to detect exceptions and trace the source of an event (Hyung & Kang, 2011). This can be achieved using the IP trace-back mechanisms along the attack path.
Additionally, modern routers have improved features, including increased static and dynamic RAM buffers. Although the improvements are meant to enhance performance, they have an advantage of static retention of evidence in every buffer load. Forensic analysts can use various software to collect evidence from the RAM dump to be used during investigations.
References
Hyung, K. & Kang, K. (2011).Network Forensic Evidence Acquisition (NFEA) with Packet
Marking. Proceedings of the Parallel and Distributed Processing with Applications
Workshops (ISPAW), 388-393
McMillan, T. (2011).Cisco Networking Essentials (1ed.).Available:
http://AUT.eblib.com.au/patron/FullRecord.aspx?p=817836