Improving the Analysis of Lawfully Intercepted Network Packet Data Captured for Forensic Analysis

Lawful interception of a suspects’ personal Internet communications can be a very effective evidence collection mechanism for use in criminal investigations. Once a lawful interception warrant has been obtained, software applications known as packet sniffers are used to capture all network packets being sent to and from a suspect’s personal computer. Existing packet sniffer and protocol analyser applications, both open-source and commercial, have limitations in their usefulness in criminal investigations. This research outlines a process and framework, the Highly Extensible Network Packet Analysis (HENPA) framework, which takes the output of a packet sniffer and processes the data to extract potential forensic evidence.