Remote Forensics
The term Remote Forensics (also identified as Network Forensics or Online Forensics by some companies) covers a broad variety of forensic approaches, but is used mostly to refer to performing computer and digital forensics remotely in an enterprise environment. It is the collection, examination, and reporting of digital evidence from a connected, operating computer on a live network.
Remote Forensics is not just network packet capture and analysis. For these types of tools, please see the Network Forensic Tools category.
The primary benefit of Remote Forensics tools is response capability; providing a method for Incident Response teams to evaluate the potentially compromised computer without the time necessary to gain physical access to the computer. Running a close second is the ability to capture volatile data that is not available once a computer is shutdown, including:
- Data in memory, such as registers and cache contents
- Running processes
- Any passwords that are stored in memory as clear text
- Executed console commands
- Currently attached devices, especially networked drives
- Open ports and listening applications
- Logged on users
Usually the investigation can be performed without the knowledge of the computer owner, allowing for discreete internal investigations.
Most Remote Forensic tools use a servlet, a piece of software installed on each computer that allows a Forensics Investigator or Incident Responder to access and analyze a computer over the network.
Be sure to investigate any solution you choose to ensure it meets your requirements for collection of valid and verifiable evidence and documentation for acceptance evidence and documentation in a court of law.
Other information about Remote Forensics:
- Remote Forensic Software - A Gartner Research Note
- Collecting Evidence from a Running Computer: A Technical and Legal Primer for the Justice Community - a presentation by Todd Shipley and Henry Reeve Esq.
- Covert Post-Exploitation Forensics with Metasploit - by R. Wesley McGrew. Not Remote Forensics persay, as the computer must be compromised to then run the forensics.