Digital Forensics for Network, Internet, and Cloud Computing

Chapter 3. Other Network Evidence

Information in This Chapter

■Overview of Botnets and Other Network-Aware Malware

■Temporal, Relational, and Functional Analyses and Victimology

■First Responder Evidence

■Dynamic Evidence Capture

■Malware Analysis: Using Sandbox Technology

Chapter 2, “Capturing Network Traffic,” covered network evidence collection that occurs in real time as network traffic transits the network. This chapter will cover pockets of network evidence that exist throughout the network on routers, switches, servers, clients, and appliances. It will describe client logs, enterprise logs, and cloud artifacts with evidence potential. It will cover dynamic, static, and behavioral (from sandbox or observations) evidence. This chapter will introduce ...