What is network forensics?

Network forensics is the capture, recording, and analysis of network traffic and related data sources to reconstruct events, identify attackers, and gather evidence of unauthorized activity. It is used in incident response, breach analysis, litigation support, and criminal proceedings where digital activity traversing a network is relevant to the matter at hand.

What data sources are analyzed in network forensics?

Network forensic analysis draws on full packet captures (PCAP), NetFlow and IPFIX records, firewall and proxy logs, IDS/IPS alerts, DNS query logs, web proxy logs, email gateway logs, VPN authentication records, and cloud service audit logs. The combination of these sources allows analysts to reconstruct communications timelines, identify data exfiltration, and attribute activity to specific users or external actors.

Can encrypted traffic be forensically examined?

Encrypted traffic can be analyzed at the metadata level even without decryption: source and destination addresses, timing, volume, and protocol patterns often reveal significant information about attacker activity. Where TLS inspection is implemented in the client's environment, GDF Miami can analyze decrypted payloads. In some cases, archived session keys or server-side logging enable retrospective decryption of captured traffic. GDF's analysts apply the most appropriate technique for the data available.

How is network evidence preserved for court?

Network evidence is preserved using write-once storage media, cryptographic hashing of capture files at collection time, and chain-of-custody documentation recording every person who handled the evidence and every system used in analysis. GDF Miami follows NIST and Department of Justice evidence handling guidelines, and all preservation steps are documented in a formal declaration that can be attached to expert reports or submitted to courts.

Forensic Services

Network Forensics: What Actually Moved Across the Wire

When the question is what someone sent, who they talked to, or how far an intruder got, the answer usually lives on the network, not on any one computer. We reconstruct network activity from packet captures, firewall logs, netflow records, VPN sessions and DNS trails, and produce the record of what actually crossed the wire, when, and to where. Findings are documented for South Florida counsel, insurers and regulators who need the technical facts to make a determination.

Network forensic analysis workflow: preservation, collection, packet and log analysis, timeline reconstruction, and expert reporting

Network analysis workstation with packet capture display and switch infrastructure in the background

What a Network Forensic Examination Actually Answers

A network analysis addresses the questions that host-based examinations often cannot:

What data left the building, and where it went

For trade-secret and departing-employee matters, the decisive record is usually in firewall and proxy logs, VPN session data and outbound DNS queries. We document the destination address, the volume transferred, the protocol used and the internal source. That evidence establishes what was misappropriated and supports both damages calculation and injunctive relief.

The full path of an intrusion, minute by minute

From an initial phishing click or exposed service to the moment data started leaving, every step an attacker took generated network artifacts somewhere: an authentication log, a firewall connection, a DNS query, a lateral SMB session. We reconstruct that sequence so counsel can put a chronology in front of a regulator or a court that says exactly what happened, when, and how the attacker got from A to B.

Whether protected data was actually reached

The threshold question in every breach, for Florida’s own notification statute, HIPAA, PCI or an insurance claim, is what data was accessible and what the attacker actually touched. We work backwards from the network evidence to give counsel a defensible answer, not an assumption, before they have to make a notice decision.

Which communications did or did not happen

In matters where a party denies sending a message, initiating a transfer or accessing a system, network records are frequently the tiebreaker. Session logs, authentication records and encrypted traffic metadata establish whether a claimed communication occurred, from what IP, over what protocol and for how long, independent of what any single endpoint’s local logs say.

What malware talked to, and what it took

Command-and-control communications, staging directories used for exfiltration and the specific families of malware involved are documented from network evidence even when the endpoints have been wiped. That evidence supports attribution, insurance coverage arguments and, where applicable, criminal referral.

Case in point

Proving the breach never reached the cardholder environment

A Miami-area hospitality property discovered a malware infection on a back-office workstation. The immediate concern was whether card data had been reached, which under Florida law and PCI DSS would trigger notification, forensic-vendor engagement with the card brands and substantial regulatory exposure.

We were retained on the incident. Rather than assume the worst and notify, counsel needed a defensible technical answer. We collected firewall connection logs, netflow records, DNS query logs and endpoint authentication records for the exposure window. The infected workstation had lateral network access to several segments, but every attempted connection into the cardholder environment had been blocked at the internal firewall. The malware had staged data locally but never established an outbound path capable of exfiltrating it.

The finding, documented and hash-verified, supported a written determination that no cardholder data had been accessed. The property avoided both the notification and the PCI forensic engagement.

How We Work

1. Preservation first

Network evidence is volatile. Packet captures may only be retained for 24 to 72 hours, firewall logs rotate on tight cycles and IDS databases can be overwritten without warning. When we are called into an active or recent incident, the first hour is preservation: capturing what is retained before it is gone.

2. Collection across every source that matters

Firewall and proxy logs, packet captures from network taps and analysis appliances, SIEM exports, VPN and remote-access logs, wireless infrastructure records, DNS query logs and NetFlow data. Every source is documented with the collection date and time, the person who performed it and a cryptographic hash of what was collected.

3. Analysis with the right tools for the question

We use Wireshark and NetworkMiner for packet-level analysis, Zeek for structured log generation from captures, Suricata for retroactive detection against historical data and analyst-written scripting for large-scale log correlation. The engagement is scoped in writing so the examination stays focused on the questions counsel actually needs answered.

4. Reporting in two layers

A technical report with every finding, timestamp, IP address, protocol detail and methodology note, enough for an opposing expert to reproduce our work. And an attorney-facing narrative that translates those findings into a plain-language chronology counsel can hand to a judge, an insurer or a regulator.

5. Testimony by the analyst who did the work

The analyst who ran the examination is the analyst who sits for deposition and testifies. Explaining packet-level detail to a non-technical trier of fact is a specific skill, and it is a requirement, not a preference, in every engagement we take.

Where Network Forensics Decides South Florida Matters

Hospitality and cruise-line breach response

Card-present environments across South Florida hotels, restaurants and cruise properties combine POS terminals, guest Wi-Fi, vendor VPNs and property-management systems in networks that are more permeable than their operators believe. Network forensics establishes what actually moved between segments, which is the threshold question for whether guest or cardholder data was reached.

Trade-secret and departing-employee matters

For construction, engineering, financial-services and equestrian-industry clients where a departing employee is alleged to have taken confidential data, network records typically produce the clearest evidence: outbound file transfers to personal cloud accounts, VPN sessions from unfamiliar geographies and volume anomalies in the days before departure.

Wire-fraud and business email compromise

For South Florida financial firms, title agencies and law offices dealing with fraudulent wire instructions, sign-in IP telemetry and gateway routing data establish when unauthorized access began and where the spoofed instruction entered the chain, the timeline counsel needs for both emergency relief and insurance recovery.

Insurance coverage disputes

When a cyber policy’s coverage turns on the timing, scope or nature of an incident, network forensics supplies the technical facts that resolve the dispute. Findings are prepared for both first-party recovery and coverage litigation.

Regulatory response

For matters before the Florida Attorney General’s office, the FTC, HHS OCR on HIPAA or the SEC, our reports are structured to be attached to a submission or filing without additional translation. The technical detail is there for the regulator; the narrative is there for counsel.

Standards and Standing

Our analysts hold certifications from SANS (GCFA, GCIA, GNFA) and vendor programs from the major security infrastructure providers. Every collection is documented against NIST SP 800-86 (network forensic evidence handling). Reports are structured for authentication under Fla. Stat. § 90.901 and Federal Rules of Evidence 902(13) and 902(14). Chain of custody is maintained from the moment we touch a log or a capture to the moment the evidence is produced, and the analyst who created it is the one who defends it.

Last updated: September 4, 2026

Preserve Network Evidence Before It Rotates Out

Packet captures and firewall logs age out fast. If there is an active or recent incident, the first call matters more than the tenth.

Request Consultation Call (786) 219-1210

Network Forensics for South Florida Matters

Many of the networks we capture from across Miami-Dade, Broward and Palm Beach share a common structural problem: segments that should be separate are not. Guest Wi-Fi sits close to a property management system, a vendor maintenance VPN reaches into a cardholder environment, and a terminal operator’s business network shares infrastructure with the systems that move containers. When something moves laterally through one of these environments, netflow and packet data are frequently the only record of it.

We deploy full packet capture and netflow collection during live incidents, and reconstruct sessions from existing captures, firewall logs and IDS telemetry after the fact. The output is a specific answer: which host initiated, which credential was used, how much data left, to where and over what window. In hospitality, cruise-line and financial-services matters that determination often supports the threshold question of whether protected information was reachable, which is what a Florida breach-notification decision turns on.

The same analysis supports cross-border fraud work. In business email compromise matters against South Florida financial firms and title agencies, sign-in IP telemetry and gateway routing data establish when access began and where a spoofed instruction entered the chain. Captures are hash-verified at collection and documented so the acquisition survives a challenge in state or federal court.