ROUTERS IN DIGITAL FORENSICS
A router can be described as a computer that has its tasks focused on sending packets on the data network. Routers are very responsible for creating connections and joints for networks by selecting the best path for a packet to pass through when reaching out to their various destinations. These routers connect each other through a routing table when forwarding data packets among them. In terms of digital forensics, forensic analysis and examination can be used on the routers to gather evidence that may be used to execute a specific criminal.
A specific analysis of a particular router’s architecture (CISCO 2800) clearly illustrated some components of it have issues that may be faulty in terms of IT audit evidence and the system improvement evidence. At times attackers reduce the number of packets to be collected, decreasing the chances of them being caught. They do so by hiding their profiles, they also hide the origin of the packet by spoofing the source’s Ip address to halt the traceback process, doing this makes the evidence searching process to be more difficult and trickier.
Routers meant to give evidence of a particular attack are supposed to show the access list; they also required to show time, the IP route of the attacker, startup configuration, show all the users who gained access to the data, and lastly, it should show its version. Routers have also been designed in a way that they have the evidential value of illustrating both static and live potential used in evidence collection. Customizations found within routers add variety to the scope of routers level of collecting evidence. The only problem that arises when data collection is concerned is the volatility of the data, which raises a little bit of concern in terms of investigations since most attackers take advantage of it.
Reference
Mazdadi, M. I., Riadi, I., & Luthfi, A. (2017). Live Forensics on RouterOS using API Services to Investigate Network Attacks. International Journal of Computer Science and Information Security (IJCSIS), 15(2).
Shin, C., Chandok, P., Liu, R., Nielson, S. J., & Leschke, T. R. (2017, June). Potential forensic analysis of IoT data: an overview of the state-of-the-art and future possibilities. In 2017 IEEE International Conference on Internet of Things (iThings) and IEEE Green Computing and Communications (GreenCom) and IEEE Cyber, Physical and Social Computing (CPSCom) and IEEE Smart Data (SmartData) (pp. 705-710). IEEE.
Szewczyk, P., & Macdonald, R. (2017). Broadband router security: History, challenges and future implications.