NetworkMiner

Session-centric network forensics and object extraction from PCAP evidence.

When to use

• You need rapid host/session overview from .pcap/.pcapng files.
• You need extracted files, credentials, DNS/HTTP metadata, or transferred objects.
• You need evidence-first triage before deep packet dissection.
• You need to pivot quickly from network traces to investigation artifacts.

Core workflow

1. Load PCAP and enumerate hosts, sessions, and protocols.
2. Review extracted objects (files, credentials, parameters, certificates).
3. Build communication sequence by source/destination and service.
4. Export relevant artifacts for corroboration with endpoint evidence.
5. Record exact packet/session references for each conclusion.