Trusted Internet forensics: design of a network forensics appliance

With the spreading of cyber-crime, computer forensics has emerged as a new discipline in the system security arena. Some work is being done towards the definition of methodologies for the collection of digital evidences from storage devices that can withstand legal analysis in court. On the contrary, the collection of network evidences that allows for a selection of the traffic and guarantees legal admissibility is still an open field. In this paper we present the architecture of TIF, trusted Internet forensics, a network appliance that collects data from the network for forensics purposes. Such an appliance relies on a trusted computing platform in order to allow for the verification of the computational chain so that the data collected could be used as evidence in court.