Digital Forensics and Incident Response

Identification

One principle that is often discussed in forensic science is the Locard's exchange principle. This principle postulates that when two objects come into contact, they leave a trace on each other. For example, if you walk into a house with carpeting, dirt from your shoes is left on the carpet and the carpet leaves fibers on the soles of your shoes. These traces that are exchanged form the bases of the science of trace evidence in the physical forensics world. In the digital world, we often have very similar trace evidence when two systems come into contact with each other. For example, if an individual browses to a website, the web server or web application firewall may record the individual's IP address within a collection log. ...