Computer and Network Forensics

This chapter introduces computer and network forensics. The world of forensics is well understood in the non-digital world, whereas this is a nascent field in the digital cyberworld. Digital evidence is being increasingly used in the legal system such as e-mails, disk drives containing damaging evidence, and so on. Computer forensics deals with preserving and collecting digital evidence on a single machine while network forensics deals with the same operations in a connected digital world. Several related issues and available tools are discussed in this chapter.