FTP (File Transfer Protocol) Forensics

 FTP is the standard for transferring files over the internet. Every time you wish to "publish" a site to the internet, you probably use FTP to do so.

Your employees , if they wish to download (especially large) files they will download them from a web page. If they want to send files from your company computers to the internet the main ways are through emails or through FTP. The emails have the disadvantage of limits to their attachments so FTP is the obvious choice.

Investigating FTP logs and temporary files, allows a forensic investigators to determine what files were transferred from the local computer to the web.

This kind of investigation is especially important for SMEs, that do not have in place the appropriate internet traffic monitoring procedures. Although from personal experience, even the largest businesses in the market can overlook basic security issues.

There are two ways of investigating a possible breach via FTP.

A. To investigate the hard drive and (where available) internet logs.
B. To orchestrate a covert operation in order to locate any illegal activity as it happens.

In both cases, Strathclyde Forensic 's  technical expertise is available to you.