From the course: Network Forensics

Unlock this course with a free trial

Join today to access over 25,500 courses taught by industry experts.

Network logs as evidence

Network logs as evidence

From the course: Network Forensics

Start my 1-month free trial Buy for my team

Network logs as evidence

“

- [Instructor] Network logs are records of user activities on hosts, including intrusion attempts and security events. They are the primary sources of information investigators use to prove a crime. However, it's important to note that network logs are also susceptible to attacks. Intruders can change, delete, and add an entry to cover their tracks. Because of this possibility of tempering, courts don't automatically accept network logs as credible evidence unless they meet certain criteria. Prosecutors are responsible for providing witness to testify about the log's integrity, reliability, and accuracy before they become admissible to the court. The custodians of the systems generating the log files are expected to be able to strongly support their authenticity. A history of prior breaches seriously weakens the credibility of the witness and the court may even reject the log data. Another requirement is keeping logs as a regular business practice, which is often required as part of…

Contents