Repurposing Network Tools to Inspect File Systems

It can be a laborious and manual process to perform computer forensics to identify files of interest on a host. Any tools that can be used to automate portions of this process will help to accelerate computer forensics and reduce the likelihood of human error. If a host is compromised it is likely that antivirus and other host- based security tools have failed to detect and/or remediate malware that caused the compromise. If a host contains a file of interest that is not specifically malware then host-based security tools will also have not detected the file. It may be beneficial to repurpose existing network based security tools and signatures to evaluate local files. Network based tools may be used as a 'second set of eyes' to inspect the file system. A possible method to perform this inspection could be to combine dd with Ncat/Netcat and Snort. In essence, the file system could be sent 'over the wire' in order to allow 'traditional' network based IDS inspection to be used in a novel manner.