# Challenges of Network Forensic Investigation in Fog and Edge Computing
## 1 Introduction  
Over the years, the design of IT infrastructures has undergone a significant evolution, driven by advancements in technology, changing requirements, and the growth of connected devices. Starting with a mostly centralized design, in which mainframes and large servers were used to process and store data, the connected client devices had limited capabilities and relied on the central infrastructure for computing tasks. This approach had limitations in terms of latency, scalability, and network dependency, so the next step was the use of distributed computing, which expanded both the capabilities of networks and the computing power of the clients. Interconnected devices and distributed computation over multiple machines inside a local area network (LAN) were typically used to increase the overall performance. The most critical problem was the inflexible design, which hampered necessary changes like adding new machines for horizontal scaling or updating internals of the underlying network. With the advent of cloud computing, the focus shifted to centralized data centers that provided scalable and on-demand computing resources over the internet. This allowed organizations the management of their computational needs and storing of large amounts of data in remote servers. Cloud computing offered flexibility, cost efficiency, and accessibility, but it also introduced new challenges related to latency, bandwidth constraints, and privacy concerns. With an increasing frequency of networking activities being involved in criminal activities, the number and importance of network forensic investigations started to grow as well [1]. Forensics of physical networks, i.e., tapping and recording at a router, had to extend to cloud infrastructures where network devices are not necessarily physical but often realized as part of the cloud software [2]. As the number of connected devices and the volume of data generated at the network edge increase, the limitations of these centralized cloud environments become more apparent. Edge computing emerged as a paradigm that aims to bring computation closer tothe data source, reducing latency and bandwidth requirements while improving response times and real-time processing capabilities. Simultaneously, the rapid evolution of Internet of Things (IoT) devices continues, and the deployment of improved computing environments has gained significant attention due to its ability to provide low-latency and real-time processing capabilities. Edge and fog environments are characterized by a large number of interconnected devices, possibly distributed over a large area, with varying levels of computational power and storage capacity [3; 4]. Thus, the distributed and heterogeneous nature of edge and fog environments introduces new challenges for conducting network forensic investigations, which extend to those environments as a consequence of their spread and relevance. Such investigations, which mainly serve to record traces of network packets for further analysis, become necessary as a consequence of the spread of edge and fog environments, be it for troubleshooting or for involvement in criminal activities [5]. Especially for the latter, completeness of recorded traces is important in a lawsuit, yet the spatial dispersion makes it challenging to obtain complete traces [1]. We investigate these challenges, i. e., we analyze the obstacles that are specific to forensic investigations in fog and edge computing environments, for example, the spatial dispersion of devices. We then strive to determine ways to overcome these obstacles by adapting processes and techniques from other branches of network forensics or creating new solutions. We also provide a discussion of open problems for forensics in fog and edge environments, and the challenges they still pose for forensic investigators. We summarize our contributions as follows.