Digital Evidence and Computer Crime, 3rd Edition

Chapter 24

Digital Evidence on Physical and Data-Link Layers

Eoghan Casey

Contents

Ethernet

Linking the Data-Link and Network Layers: Encapsulation

Ethernet versus ATM Networks

Documentation, Collection, and Preservation

Analysis Tools and Techniques

The physical and data-link layers provide the foundation for everything else on a network. The physical layer is the medium that carries data—such as the cables, radio waves, microwaves, or lasers. The data-link layer joins a computer with the physical layer, and includes the transmission method (e.g., CSMA/CD) as mentioned in Chapter 21. Network Interface Cards (NICs) are part of the data-link layer—connecting computers to the network cables. Each NIC has a unique address (machine access control ...