Popular messaging applications now enable end-to-end-encryption (E2EE) by default, and E2EE data storage is becoming common. The properties of both hardware appliances and packet analyzer software are reviewed from the perspective of their potential use in network forensics. Considering that not all network information can be used in court, the types of digital evidence that might be admissible are detailed. This paper is a comprehensive survey of the utilization of packet analysis, including deep packet inspection, in network forensics, and provides a review of AI-powered packet analysis methods with advanced network traffic classification and pattern identification capabilities. This can be used to find traces of nefarious online behavior, data breaches, unauthorized website access, malware infection, and intrusion attempts, and to reconstruct image files, documents, email attachments, etc. Packet analysis is a primary traceback technique in network forensics, which, providing that the packet details captured are sufficiently detailed, can play back even the entire network traffic for a particular point in time.

Network packet analysis