Digital Forensics and Incident Response - Second Edition

Identification

One principle that is often discussed in forensic science is Locard's exchange principle. This principle postulates that, when two objects come into contact, they leave a trace on each other. For example, if you walk into a house with carpeting, dirt from your shoes is left on the carpet, and the carpet leaves fibers on the soles of your shoes.

These traces that are exchanged form the basis of what is termed trace evidence in the physical forensics world. In the digital world, there is often very similar trace evidence left when two systems come into contact with each other. For example, if an individual browses a website, the web server or web application firewall may record the individual's IP address within a collection ...