Practical Information Security

So one of the cool things I learned in my SANS-508 class a couple years back was how to identify and carve files out of a network capture file. I had knew it was possible, and I have seen other folks do it before, but up until then I hadn't pulled out entire files from network captures. I think a good network security/forensic security professional should have that skill (to be able to look at a PCAP and locate the files and be able to extract them manually) but many times it is somewhat tedious to do this, and it may be prone to error. Recently SANS published a list of tools for doing this (including Foremost which was also used in the SANS 508 training). http://isc.sans.org/diary.html?storyid=6961 Here is the article: Published: 2009-08-13, Last Updated: 2009-08-16 00:42:14 UTC by Jim Clausing (Version: 2) Often in the course of investigating a compromised machine or when analyzing malware in a sandnet or honeynet, I will have a complete capture of all the network activity in a...