In this chapter, we discussed some topics on network forensics. We learned what kind of data we could collect from a network and how to analyze logs from a proxy server. Also from this chapter, we learned how to collect pcap files and how to analyze them with WireShark and Bro.
In the following chapter, you will learn how to build a forensic environment. We will describe two approaches; one of them is virtualization, and another one uses distributed systems. We will describe GRR as an example of a distributed system.
