Chapter 3. Other Network Evidence
Information in This Chapter
Chapter 2, “Capturing Network Traffic,” covered network evidence collection that occurs in real time as network traffic transits the network. This chapter will cover pockets of network evidence that exist throughout the network on routers, switches, servers, clients, and appliances. It will describe client logs, enterprise logs, and cloud artifacts with evidence potential. It will cover dynamic, static, and behavioral (from sandbox or observations) evidence. This chapter will introduce ...