The sensitive nature of mobile network forensics requires careful organization of the investigative processes and procedures to ensure legal compliance and adequate privacy protection. Investigations in mobile networking environments can be conducted for two main purposes: (1) to reconstruct criminal activities facilitated by a use of a mobile service and (2) to attribute malicious attacks targeting the normal operation of the mobile infrastructure. In both cases, investigators need to know the concepts introduced in the previous chapters to operationalize any mobile network related investigation. This chapter elaborates the legal framework, the general investigative principles, and evidence types characteristic for investigations in mobile network infrastructures.
Packet analysis for network forensics: A comprehensive survey
