Packet Captures, Flow Records and Firewall, VPN and DNS Logs

Network Forensics for Traffic, Flow and Log Reconstruction

When an intruder moves through a network or an employee sends files where they should not go, the traffic leaves a record even when the endpoints do not. Global Digital Forensics preserves packet captures, flow records and firewall, proxy, VPN and DNS logs before they rotate, and reconstructs who connected to what, when and how much left.

Get a Free Consultation Call (800) 868-8189

Bagged hard drive beside a forensic write blocker.

Find the Traffic and Logs That Still Hold the Answer

Network evidence is perishable. Captures are rarely running when the event happens, flow records roll over and firewall logs rotate on a schedule nobody remembers setting. For past activity we work from what each device retained for the relevant period, and before any new capture we agree the systems, capture points, observation window, minimization of sensitive content and handling rules, so the new evidence is clean from its first packet.

A retained payload that is complete and readable supports content analysis: the file, the message, the command. Encrypted traffic, flow records and partial captures support the endpoints, the timing and the volume instead, and the report says precisely which kind of proof each session carries, so the argument in court is about what happened rather than what the record can bear.

We record packet loss, retention, sensor location, address translation mappings, clock offsets and shared account conditions. Sessions are tied first to observed addresses and identities and then to corroborating endpoint and account evidence, because an address becomes a person and a port becomes a file only when other records connect them. The process follows NIST SP 800-86, Guide to Integrating Forensic Techniques into Incident Response.

If you are not sure which logs your equipment still retains, get a free consultation and we will help you find out before the next rotation.

Get a Free Consultation

Methodology

Define, Preserve, Correlate and Explain

Define the event and the network sources

We fix the activity, the period, the people, the systems and the readers of the report, so preservation targets the questions your team needs answered rather than everything that happens to be logged.
Preserve traffic and logs before they rotate

Captures and logs are preserved with source condition, integrity checks and custody records, shortest retention first.
Examine and correlate the communications

Network events are lined up with endpoint, operating system, application and account artifacts, so the network record confirms or challenges each account of events.
Explain the network findings

Observed traffic is kept apart from interpretation, and the methods and coverage are documented for any qualified examiner to review.

Logs rotate on nights and weekends too. The 24/7 hotline at (800) 868-8189 reaches an examiner who will tell you what to export before the next rotation.

Evidence commonly examined

Network Evidence We Examine

Packet captures, NetFlow and sFlow exports, and firewall, proxy, VPN, DNS, wireless and intrusion detection records carry the communications themselves. Endpoint images, operating system and application artifacts connect each communication with local activity, and account, network and cloud records supply identity, session and service context. Backups, snapshots and SIEM archives often hold logs the live system has already discarded.

What you can expect

Your Communications Timeline and Report

You receive an acquisition record documenting source condition, collection methods and integrity verification, artifact schedules and an event timeline that organize every communication with its supporting records, technical findings that identify the evidence behind each conclusion, and the reports, declarations and testimony the expert assignment calls for.

Bring the Network Evidence to a Court Qualified Examiner

Bring the network event, the retained sources and the deadline to a free initial consultation. A senior examiner sets the preservation priorities with you on that call and covers experience, conflicts and scope before anything is engaged.

Robert Knudsen pairs the CISSP and CompTIA Network+ and Security+ with 18 years of forensic experience and hundreds of examinations supporting federal and state court matters. Founder Joseph Caruso, also a CISSP, has worked in technology since 1980 across real time transaction systems, cellular networks and cybersecurity incident response. The examiner profiles show who would handle your network sources.

Get a Free Consultation

Technical methods and scope

Reconstruct Communications From Network Sources

Network evidence records communications between systems through retained traffic and infrastructure activity. It corroborates endpoint records and fills the gap when a host record was altered or lost, and we examine the connections, protocols and anomalies to establish what the sources show about the event.

A network examination draws on the traffic, flow, infrastructure and authentication records the environment retained.

Captured content is reconstructed where the payload kept enough readable data and the method is authorized; encrypted sessions and flow records yield communication metadata instead.

We examine TCP/IP, DNS, HTTP, HTTPS, SMTP, IMAP, FTP, SSH, RDP, SMB, LDAP, Kerberos and custom protocol records for the communication and the behavior each one exposes.

Firewall connections, proxy access and URL filtering records reconstruct routes, policy events and the paths data could have taken.

Intrusion detection and prevention alerts are correlated across time and infrastructure and tested against the other evidence before any attack sequence is described.

NetFlow and sFlow document volumes, connection patterns and transfer quantities when full packet capture is unavailable, which is most of the time.

DNS queries and responses are examined for command and control, tunneling, generated domains and reconnaissance, and tied into the wider timeline.

Wireless access point logs, 802.11 captures and management records show device activity and unauthorized wireless access.

VPN connections, authentication logs and session metadata show who came in remotely and under what authorization.

Where content cannot be decrypted, connection details, certificates, timing and behavior characterize the encrypted communication.

All of it is reconciled into one chronological account, with the source and time basis behind each material event.

Network records independently corroborate disputed communications, data transfer and the observed extent of a breach, weighed against sensor placement, retention, clock alignment, encryption and the logging coverage in force at the time.

Preservation and Analysis That Stand Up to Cross Examination

We preserve captures and infrastructure logs in order of relevance and retention, because those sources rotate quickly. The collection record and the documented analytical choices keep observed traffic distinct from inference and leave a history another examiner can review.

Agreed collection can include router and firewall exports, network tap or appliance captures, SIEM records, proxy and VPN logs, wireless infrastructure and NetFlow exports. Each source carries its collection time, operator, method, scope, integrity values and custody transfers, so its origin and handling can be explained under cross examination.

We combine manual examination with protocol analyzers, artifact extractors, structured traffic tools, detection engines and correlation scripts, recording each tool and version. The timeline identifies supported actions, affected systems and the evidence of access or transmission, with every inference marked as one.

The technical report cites timestamps, source and destination addresses, attribution, byte volumes, protocol detail and examination notes for each finding, and a plain language summary connects the results to the questions you asked. When retained, the examiner explains the methods and the protocol behavior in deposition or at trial.

Send the question and the sources you know about, and we will map the examination with you.

Frequently asked

Planning a Network Forensic Examination

What should we define before the examination begins?

The available packet captures, the firewall, VPN and flow records, their retention periods and the incident window. If you do not know what is retained, tell us what equipment you run and we will help you find out before it rotates.

What should we provide for the first discussion?

The question, the sources, the dates and the deadline. Keep the originals intact and leave logging exactly as it is configured. Transfer runs over a secure method we arrange, under a custody record that starts before the first file moves.

Can the examination focus on a specific issue?

Yes. The agreed scope names the authorized data, the methods and the deliverables for the specific question, which keeps the cost in proportion to the dispute.

Can we review the qualifications of the proposed examiner?

Yes. Ask for a current CV, relevant experience and availability. Conflicts and expert disclosure requirements are cleared before engagement, and the examiner who does the work is the examiner who explains it.

Free consultation

Follow the Communications Behind Your Incident

On the first call a senior examiner takes the incident window, the network layout and the captures or logs you hold, tells you which sources to export before they rotate and outlines the collection, the analysis and the report.

The 24/7 hotline reaches an examiner directly.

GDF does not accept pro se litigation cases, and GDF may decline matrimonial or family law cases at our discretion.

Reviewed by Joseph Caruso, Founder, CEO and CTO, CISSP. Last reviewed November 3, 2026.