# Challenges of Network Forensic Investigation in Fog and Edge Computing
## 4 Challenges  
The change in behavior in networking and the mixture of different technologies, processes and interconnections have a huge impact on the forensic investigation inside these environments. This section lists relevant challenges encountered during network forensic investigations in edge and fog environments. Each challenge is discussed and its impact on the investigation process is presented. To ensure a systematic process and to obtain a list of requirements that is as complete as possible, we take software testing as an example and role model [43]. By this, we mean that we mentally apply the _concepts_ of unit and integration tests onto the fog, edge and cloud structures in which forensic investigations are conducted. As we are not performing additional experiments for the present research alone, we mentally apply those concepts but do not actually perform a test on a real, distributed software system. By mentally applying the test concepts, we do not mean explicitly formulating a concrete hypothesis and formally testing mentally whether the hypothesis holds in the scenario, but arguing whether certain problems occur within a network component or during the collaboration of network components during capture and record of network packets. Extracting the challenges also involves concepts like bug hunting, i.e., looking at some scenarios in more detail or at a more detailed level. To complement and enhance the above approach, we use the literature and our multi-year experience in this field. Yet, we are aware that--as with any approach that is not completely formal and does not guarantee to prove properties as, e.g., in [44]--such a list of requirements remains a best-effort approach. Software testing, ranging from bug hunting to unit and integration tests, deals with differences between software specification and software implementation. Finding the cause for such differences is achieved in as systematic a manner as possible, yet it is helpful to know where to look first, i.e., for typical causes. For example, especially in embedded software, device characteristics and communication with other entities plays a role. * **Device variety** The number of possible devices in fog and edge environments differs from small installations with only a few, mostly homogeneous devices to large-scale environments with a huge variety of different components. On the one hand, such devices are limited in their performance and software possibilities, for example, single-board computers like Raspberry Pi or Arduino, industrial gateways and Programmable Logic Controllers (PLCs) with a specific and robust network connection and industrial-grade specifications, smart cameras for real-time video and object identification, drones and autonomous vehicles, wearable devices like smartwatches or fitness trackers. Their job is to process and analyze the data on board. This enables real-time decision and autonomous operations in various applications without a continuous network connection to a central server. On the other hand, high-powered devices like edge servers and routers, which can be rack-mounted or in a smaller form factor, have higher computational resources. They provide increased processing power, storage capacity, and networking capabilities. The devices differ in their physical interfaces to connect to a network as well as in the deployed protocols and communication techniques. Some devices are always on and send data periodically; other devices are in stand-by for a longer period, but then send a bunch of data at a random timeslot. This variety of involved devices hampers an easy data acquisition process and demands a flexible and versatile capture process. * **Cloud computing interaction** The evolution of fog and edge computing is blurring the lines between edge and cloud environments, creating a continuum that spans from the cloud to the edge devices. Organizations are adopting hybrid architectures that leverage the strengths of both edge and cloud computing.