File Toolkit for Selective Analysis & Reconstruction (FileTSAR) for Large-Scale Networks

There are many challenges in digital forensic investigations involving large-scale computer networks; these include large volume of data, the limited scope of tools, the financial burdens of purchasing and licensing those tools, and identifying salient evidence from the vast amounts of network data. We have implemented a collection of open-source tools and code wrappers to provide a tool for network forensic investigators to capture, selectively analyze, and reconstruct files from network traffic. The main functions of this tool (FileTSAR) are capturing data flows and providing a mechanism to selectively reconstruct documents, images, email, and VoIP conversations. To validate the large-scale capabilities of the toolkit, we conducted a "stress test" of the system using approximately 123,500,000 packets from a collection of packet capture files totaling nearly 100GB. Additionally, sixteen (16) digital forensic examiners participated in a 3-day law enforcement training workshop for FileTSAR from across the United States; the examiners expressed substantial support for FileTSAR with large-scale investigations as well as an interest in a scaled-down version for smaller agencies with storage, budget, and back-end support limitations.