Digital Forensics and Incident Response - Second Edition

Analyzing Log Files

The Sherlock Holmes of France, Dr. Edmond Locard, was a pioneer in the field of forensic science. A criminologist and teacher, Locard developed techniques and methodologies that still inform forensic science today. One principle for which he is well known is Locard's exchange principle. This principle states that when a suspect interacts with a crime scene, they leave traces behind. In the physical world, this can include hair, fibers from clothing, blood, or skin, which is left on the various surfaces and objects within the crime scene. The crime scene itself also leaves traces on the suspect. Fibers from the carpet, dust, metal fragments, or glass from a broken window may make its way onto the suspect. Forensic science ...