From the course: Network Forensics

Unlock the full course today

Join today to access over 23,300 courses taught by industry experts.

Network logs as evidence

Network logs as evidence

From the course: Network Forensics

Start my 1-month free trial Buy for my team

Network logs as evidence

“

- [Lecturer] Network logs are the records of user activities on hosts some of which include intrusion attempts and security events. They are the primary sources of information investigators use to prove a crime. However, it's important to note that network logs are also susceptible to attacks. Intruders can change, delete, and add an entry to cover their tracks. Because of this possibility of tampering, courts don't automatically accept network logs as credible evidence unless they meet certain criteria. Prosecutors are responsible for providing witnesses to testify the integrity, reliability, and accuracy of the logs before they become admissible to the court. The expectation is that the custodians of the systems generating the log files can strongly support their authenticity. A history of prior breaches seriously weakens the credibility of the witnesses and the court may even reject the log data. Another requirement is keeping logs as a regular business practice which is often…

Contents