Last updated: May 1, 2026
When an incident happens, the network is usually the only place where the full story is recorded — the endpoint can be wiped, logs can be tampered with, but packets-on-disk reflect what actually moved across the wire. Network forensics is the discipline of reconstructing the incident from that evidence. This module is the working introduction; pair with Module 2 (Wireshark fundamentals) and Module 15 (telemetry).
The forensic mindset — what we are actually trying to prove
Forensics is not just “look at the packets” — it is “answer specific questions defensibly”. Typical questions: when did the attacker first arrive? What did they reach? What did they take? How did they get in? Did they create persistence? Each question is addressed with a different lens: time-correlation across PCAP, flow logs, Zeek logs, and endpoint telemetry.
The forensic principleevery answer must be reproducible from the same evidence and resilient to challenge — by the attacker if there is later litigation, by the auditor when reviewing the post-incident report, by counsel preparing for regulatory notification. Sloppy provenance kills cases; “we think it happened around then” is not a finding. Always cite specific evidence (PCAP file + frame number, log file + timestamp + line) for every conclusion.
Custom team training + practitioner advisory
Beyond the free academy — we run private workshops, vCISO advisory, and red-team exercises tailored to your stack. For Indian SMBs scaling past their first hire.