14.5 Summary

Without an understanding of where information can be found on networks, digital investigators are guaranteed to waste a significant amount of time and are likely to lose valuable digital evidence. Additionally, without an understanding of how networks function, digital investigators will have a harder time making sense of any data they obtain from a network. To address this need, Chapters 16–18 cover three important layers of the OSI model. Chapter 16 details Ethernet and provides guidance for processing digital evidence at the physical and data-link layers. Chapter 17 covers the basics of TCP/IP and describes how digital investigators can process and utilize log files, state tables, and other data relating to the network and transport layers. Chapter 18 discusses the Internet as a source of evidence and addresses key challenges, including anonymity.