Digital Forensic Evidence

Computer/cyber related criminal attacks become more predominant in today’s technologically driven society the need for and use of, digital evidence in courts has increased. There is the urgent need to hold perpetrators of such crimes accountable and successfully prosecuting them. The process used to acquire this digital evidence is digital forensics. Digital forensics is a new and developing field still in its infancy when compared to traditional forensics fields such as botany or anthropology. Over the years development in the field has been tool centered, being driven by commercial developers of the tools used in the digital investigative process. This, along with having no set standards to guide digital forensics practitioners operating

People use them to communicate, to create intellectual property, to shop, to perform business transactions, to plan trips, and much more. Networks afford users the opportunity to continuously use computers through cell phones, personal digital assistants (PDAs), wireless connectivity, and the ubiquitous Internet. Any computer can be used for many purposes, just because a computer is located in the workplace does not mean that the computer is used only for work. The pervasive nature of computers and networks means that they are increasingly connected to incidents and crimes. And wherever crime took place these mysterious questions comes under the mind of investigator or network administrator, who is involved in this? Who is responsible for obtaining this information? How can relevant information be obtained from computers to support criminal, civil, or disciplinary action? And The Network Forensics is the answer of all these questions. You might hear the term cyber forensics or digital forensics; they usually refer to network forensics, not computer forensics. And “Network forensics is a process of detecting and analyzing the attacks on the network that jeopardize the Confidentiality, Integrity and Availability of an IT

A Log File is composed of log entries and each log entry contains useful information associated with events that occur in the system, network, virtual machine, or application. However Log file entries differ with respect to their types and requirements. Log Messages are a nice way for any application to convey messages about its current actions to human users, consequently logging is considered an essential means of security control which helps the investigators in identifying, answering, and precluding operational issues, incidents, violations, and fraudulent activities [12]. Fig. 2.1 shows the overview of log files. Ordinarily multiple software and hardware maintains log files, but here we are getting an overview of log files of our concern