Using Search Engines to Acquire Network Forensic Evidence

Search engine APIs can be used very effectively to automate the surreptitious gathering of information about network assets. This paper describes GooSweep, a tool that uses the Google API to automate the search for references to individual IP addresses in a target network. GooSweep is a promising investigative tool. It can assist network forensic investigators in gathering information about individual computers such as referral logs, guest books, spam blacklists, and instructions for logging into servers. GooSweep also provides valuable intelligence about a suspect’s Internet activities, including browsing habits and communications in web-based forums.

Authors and Affiliations

1. Computer Science and Engineering, Mississippi State University, Mississippi State, Mississippi

   Rayford Vaughn (Professor)

Editors and Affiliations

1. University of Central Florida, Orlando, Florida, USA

   Philip Craiger

2. University of Tulsa, Tulsa, Oklahoma, USA

   Sujeet Shenoi

Reprints and permissions

© 2007 International Federation for Information Processing

Policies and ethics