Part I. Foundation

Chapter 1, “Practical Investigative Strategies,” presents a myriad of challenges faced by network forensic investigators, introduces important concepts in digital evidence, and lays out a methodology for approaching network-based investigations.

Chapter 2, “Technical Fundamentals,” provides a technical overview of common networking components and their value for the forensic investigator, and presents the concept of protocols and the OSI model in the context of network forensic investigations.

Chapter 3, “Evidence Acquisition,” dives into passive and active evidence acquisition, including hardware and software used for sniffing traffic, as well as strategies for actively collecting evidence from network devices.