Digital Forensics and Incident Response - Fourth Edition

5 Collecting Network Evidence

Join our book community on Discord

https://packt.link/SecNet

The traditional focus of digital forensics has been on locating evidence on a potentially compromised endpoint. More specifically, computer forensics is largely focused on a system’s storage. Law enforcement officers interested in criminal activity such as fraud or child exploitation can find the evidence required for prosecution on a single hard drive. In the realm of incident response, though, it is critical that the focus goes far beyond a suspected compromised system. For example, a wealth of information can be obtained within the hardware and software ...