Practical Windows Forensics

Chapter 12. Network Forensics

Network forensics is a separate large area of Computer Forensics. It also includes various fields. Under network forensics, we should understand forensics where the main evidence is researched digital network traffic logs of network equipment, network applications, such as proxies, firewalls, servers, and so on.

Together with a conventional host-based network, forensics allows us to resolve the incident more efficiently. Information from the network layer provides a complete picture of what happened. Moreover, in some cases the analyst does not have access to these compromised machines because attackers use encryption, delete files, or use other techniques to hide information.

In cases of complex targeted attacks, initial ...