Network Forensics

In the last few decades, networks have grown to accommodate evolved technologies on every open system for interconnection (OSI) level. On the physical and data link layers, numerous wireless innovations introduced the mobile networks and the interconnection of smart objects. The innovations in network abstraction introduced the cloud- and software-defined networking environments. The high rate and diversity of networking innovations requires adaptations in the forensics approach, so the practice remains capable of uncovering evidence. This chapter explores the operational aspect of both the traditional and the evolved network forensics.