Improving the Analysis of Lawfully Intercepted Network Packet Data Captured for Forensic Analysis

Lawful interception of a suspects´ personal Internet communications can be a very effective evidence collection mechanism for use in criminal investigations. Once a lawful interception warrant has been obtained, software applications known as packet sniffers are used to capture all network packets being sent to and from a suspect´s personal computer. Existing packet sniffer and protocol analyser applications, both open- source and commercial, have limitations in their usefulness in criminal investigations. This research outlines a process and framework, the highly extensible network packet analysis (HENPA) framework, which takes the output of a packet sniffer and processes the data to extract potential forensic evidence.