Network forensics can be defined as the sniffing, recording, acquisition and analysis of the network traffic and event logs in order to investigate a network security incident.

• A. It is False
• B. True
• C. It is limited to IP addressing
• D. It focuses only on firewall logs

Answer: (B)

Network forensics focuses on sniffing, recording, acquiring, and analyzing network traffic and related logs to investigate a security incident. In practice, this means capturing packets (via taps or SPAN ports) and gathering logs from diverse sources such as firewalls, routers, switches, IDS/IPS, servers, and endpoints. Analyzing this data lets you reconstruct the incident timeline, trace attacker methods, correlate events across systems, and preserve evidence with proper chain of custody for potential legal or organizational use. The description is not limited to IP addressing or firewall logs; those elements are just parts of the broader data sources involved in network forensics. Therefore, the statement is accurate.