Specialized Forensic Domains

Network forensics reconstructs events from captured network traffic, using tools such as Wireshark to inspect packet captures and identify what data moved between systems, when, and by what protocol. Because live network traffic is itself volatile and often not retained by default, network forensics depends heavily on whether an organization was already capturing traffic, through tools like full packet capture appliances or logs from firewalls, intrusion detection systems, and proxies, before an incident occurred; investigating after the fact with no prior capture in place often leaves significant gaps. Analysts look for patterns such as unusual outbound connections, data transferred to unfamiliar destinations, or the specific commands exchanged during an intrusion, piecing together a timeline of an attacker's actions across the network layer.