Acquisition of Network Device Evidence System (ANDES)

ANDES will serve the needs of law enforcement and the NIJ by enabling an investigator to quickly and automatically acquire data from network devices without device-specific knowledge. The software will identify network devices and acquire data using configuration files that can be easily written by an investigator familiar with a specific networking device.
These configuration files can be distributed to other investigators, allowing device-specific forensic procedures to be shared within the law enforcement and computer forensics communities. To ensure investigative and prosecutorial value, ANDES will perform its tasks in a forensically-sound manner, including fully documenting the investigative process in the ANDES audit log.

ca/ncf