Computer Forensics
Network traffic collected over several days' activities is provided (in TCPDUMP format). The collected data include traces of attacks conducted by an external hacker against our network. Analyze the network capture of the hacker's activity and decode the hacker's actions.
Answer in particular to the following questions:
1. What is the ip address/country of the attacker and victim machines?
2. What is the operating system of the victim machine? Explain how you determine that?
3. How did the attacker break into the system?
4. Which systems were used in this attack, and how?
5. When did the attack start, when did it end?
6. Create a diagram that demonstrates the sequences involved in the attack.
A forensic investigation report summarizing your findings. Please submit in PDF format.