新聞財經娛樂♬資訊 News Economy

I am looking for software designed to display the history of all traffic on a network computer  including downloads, internet history, viewed files. The environment is a  Windows 2003 server with windows 7 local os. The user of the software will be a network administrator.

Hard to find an all in one tool since there are really couple of area to retrieve to build a "story" line.....
- Hard drives: file system, web browsing history, registry hives, Windows short cut files, firewall logs, restore points, volume shadow copies, prefetch files, email files, or Office documents
- Memory: network connections, processes, loaded dlls, or loaded drivers
- Network shares: email files (including archives), office documents, or PDFs
- Network logs: firewall logs, IDS logs, proxy server logs, web server logs, print/file server logs, or authentication server logs

For internet history timeline, you can catch timeline viewer @ http://www.osforensics.com/timeline-viewer.html

For endpoint of interest, SIFT may be considered to build timeline via Log2timeline
http://www.forensicswiki.org/wiki/Log2timeline
http://computer-forensics.sans.org/blog/2012/01/20/digital-forensic-sifting-targeted-timeline-creation-and-analysis

For network, key is as long as there is log, and packet capture, then the tool can act on the PCAP also the SSL traffic need to be decrypted ... I see SIEMS as a good technology to venture like Splunk - http://splunk-base.splunk.com/apps/29008/sos-splunk-on-splunk
@ http://cashandmeat.blogspot.sg/2013/03/splunksaturday-aggregating-packet.html

nDPI is used by both ntop and nProbe - Appl classification
http://www.ntop.org/ntop/ntop-is-back-ntopng-1-0-just-released/
https://www.alienvault.com/resource-center/tech-talks/a-quick-chat-luca-deri-creator-of-ntop
http://www.ntop.org/products/ndpi/

Lancope Stealthwatch - Looks at netflows (augment the packet/log)
http://www.lancope.com/solutions/security-operations/forensics/

ChaosReader -  trace TCP/UDP/... sessions and fetch application data from snoop or tcpdump logs.
http://www.windowsecurity.com/articles-tutorials/windows_networking/Studying-Network-Activity-Using-Chaosreader-Tool.html

RSA NetWitness Investigator -  
http://singapore.emc.com/security/rsa-netwitness.htm#!freeware
http://singapore.emc.com/security/rsa-netwitness/rsa-netwitness-investigator.htm