Lab #8 - Assessment Worksheet

Decoding an FTP Protocol Session for Forensic Evidence

1.Which analysis tool used in this lab helps organize the protocol session and interaction for easier protocol analysis and forensic investigating?

2. How are protocol capture and analysis linked to digital computer forensic investigations?

3. What is the source IP address of the FTP client workstation and FTP server?

4. What was the user name and password for the successful FTP connection?

5. What is the MAC layer address of the FTP client workstation and FTP server?

6. What are the names of the two text files that were transferred to the server using FTP?

7. What is the port number for FTP? What would you recommend for securing FTP through the public Internet?

8. What was the total size of the FTP file transfer?

9. What is the directory on the FTP server where the two text files are located?