Footprint (Forensic)
In network forensics, the **footprint** is the impact an investigator leaves on the systems under examination. Every interaction with a live system modifies it in some way—just as…
#network-forensics
12 published notes
Direct Evidence
**Direct evidence** is testimony from a **direct witness** who personally observed the act or event in question. It is based on firsthand human perception rather than inference fr…
Hearsay
**Hearsay** is an out-of-court statement offered to prove the truth of the matter asserted. Under the **U.S. Federal Rules of Evidence (FRE)**, hearsay is generally **not admissib…
Business Records
**Business records** are documents or data that an enterprise routinely generates and retains as part of its normal operations, and that are considered accurate enough to guide ma…
Digital Evidence
**Network-based digital evidence** is digital evidence produced as a result of **communications over a network**. It is a subset of **[[Digital Evidence]]**, but it is distinguish…
Real Evidence
**Real evidence** is a physical, tangible object that played a relevant role in the event being investigated. It is the kind of evidence a jury can see and touch, such as the murd…
Live Breach
A **live breach** is an active, ongoing security incident in which an attacker is currently connected to or operating inside a network while the investigative response is underway…
OSI Model
The **OSI model** (Open Systems Interconnection) is a seven-layer framework developed by ISO for designing and understanding network communications. Each layer solves a discrete …
Protocol (Networking)
A **protocol** is a set of formal rules describing how to transmit data, especially across a network. Protocols are: - Rules for successful communication between different system…
Circumstantial Evidence
[[Circumstantial Evidence]] is evidence that does **not directly prove a conclusion**, but can be linked with other evidence to **deduce** what happened. It requires inference and…
Best Evidence
**[[Best Evidence]]** is the **best available evidence that can be produced in court** to prove the content of a writing, recording, or photograph. Under the **U.S. Federal Rules …
Internet Protocol Suite
# Internet Protocol Suite The **Internet Protocol Suite**, also known as the **TCP/IP protocol suite**, is the collection of protocols used to implement networking functions on t…