Digital Forensics & Incident Response Investigation
Correlating host and network evidence to reconstruct suspicious activity.
- Context
- Academic investigations and personal practice
- My role
- Host and network evidence analysis; reporting
- Status
- Investigations and written findings completed
- Deliverable
- Correlated activity, likely root cause and remediation notes
Decision & evidence
Separate observations from conclusions
I correlated host artifacts, packet captures and authentication activity rather than treating a suspicious file or reputation result as a complete explanation.
A report should make clear what the evidence shows, what remains an inference and which additional evidence would resolve it.
Synthetic investigation showcase · downloadable packet capture
Case 01: The recurring connection
Follow a fictional workstation from routine browsing to recurring HTTP check-ins and a small file upload. Open the capture in Wireshark, correlate it with host events and inspect the evidence behind the conclusion. All traffic was generated offline for this portfolio; the payloads are harmless text.
- Packets
- 59
- TCP conversations
- 5
- Host events
- 8
Explore the evidence
- 1Open the evidence
Download the evidence pack, verify SHA256SUMS.txt, then open case-01.pcap in Wireshark. Set the time display to UTC. The capture and host log use the same clock.
- 2Follow the connections
Use the filters below to compare the routine update request with the recurring connections. Right-click an HTTP packet and choose Follow → TCP Stream to see the conversation.
- 3Correlate the host activity
Match connection times and source ports to host-events.csv. Compare the process’s file-read event with the upload, then expand the walkthrough below.
- Name resolution
dns- HTTP requests
http.request- Recurring destination
ip.addr == 203.0.113.80- File upload
http.request.method == "POST"
Explore the timeline & investigation walkthrough
1 October 2026 · UTC · HTTP request frames from the downloadable capture
- Frame 6 · TCP stream 0
GET
/release-notes.txt
updates.demo.test · 198.51.100.20 - Frame 19 · TCP stream 1
GET
/checkin?device=LAB-WS01
telemetry.demo.test · 203.0.113.80 - Frame 30 · TCP stream 2
GET
/checkin?device=LAB-WS01
telemetry.demo.test · 203.0.113.80 - Frame 41 · TCP stream 3
GET
/checkin?device=LAB-WS01
telemetry.demo.test · 203.0.113.80 - Frame 52 · TCP stream 4
POST
/upload/inventory-demo.csv
telemetry.demo.test · 203.0.113.80
- Establish a baseline
- The first HTTP stream requests release notes from updates.demo.test (198.51.100.20). Treat this as comparison traffic, rather than assuming every external connection has the same purpose.
- Recognize a pattern
- Three GET requests to telemetry.demo.test (203.0.113.80) are spaced exactly 30 seconds apart. Regular timing suggests automated activity, but does not establish malicious intent.
- Identify the transferred data
- The POST to /upload/inventory-demo.csv carries a two-row fictional inventory CSV. Follow TCP stream 4 to inspect its plaintext body; the byte count excludes HTTP headers.
- Correlate independent artifacts
- The supplied host events associate the three check-ins and the upload with lab-uploader.exe, PID 2400, using matching times and local ports. A file-read event occurs five seconds before the upload begins.
- Report the limits
- The artifacts support recurring automated communication and an observed file transfer. They do not establish whether it was authorized, how the process arrived, or whether it was malware. Confirm process provenance, software inventory and authorization before containment.
Verify the recovered upload
81 bytes of CSV body data, including LF line endings. Compare the SHA-256 of the extracted body:
d76df9e57069c107a271bc1439d42ff4268966e911aba86ce0b72b1f4ebd669bA new, curated portfolio demonstration—not a recording of an employer incident. HTTP is intentionally unencrypted for inspection. Documentation IP ranges and .test domains are used throughout; no executable payloads are included.
Overview
Conducted digital forensic investigations across host artifacts and network evidence using FTK Imager, Autopsy, Wireshark and VirusTotal.
Objective
Reconstruct suspicious activity, identify abnormal behavior and likely root cause, and communicate findings in a form that supports remediation.
My contribution
- Examined digital artifacts, packet captures, suspicious files and URLs, authentication activity and indicators of compromise.
- Correlated host and network evidence to reconstruct attack activity.
- Documented investigative findings, likely root cause and remediation actions.
Technical approach
- Used FTK Imager and Autopsy to examine host evidence and Wireshark to investigate network activity.
- Examined suspicious files and URLs with VirusTotal, then correlated these observations with authentication activity and other indicators.
Scope & considerations
Evidence correlation matters more than an isolated alert. Findings distinguish observed abnormal behavior from a likely root cause so that the report communicates the limits of the available evidence.
Outcome
Demonstrates host and network forensics, incident investigation, evidence correlation and structured technical reporting.