Wireshark as a Forensics tool

The types of information that can be gathered through Wireshark are:-

- Wireshark can be used to identify who initiated the attack, as we know that in forensic how important it is to identify a culprit or an accused to get the investigation started.
- Wireshark can be used to know how exactly the attack has been implemented on a system.
- Wireshark can be used to identify what all information or Data has been compromised from a device or network.
- It is helpful in finding out if the attacker has left anything in the system like a Trojan horse or a botware which can be used later to compromise the system.

- It also tracks the amount of the data collected and what all has been analyzed and should be analyzed. In short, determines whether there is enough data to analyze the network.

#wireshark #forensics #digitalforensics #networkforensics