# Challenges of Network Forensic Investigation in Fog and Edge Computing
## 4 Challenges
Critical and time-sensitive tasks are executed at the edge, while data that are not time critical are sent to the cloud for further analysis and storage, but the scheduling of this processing is again a complex problem [45]. A possible solution is the implementation of fog devices that create a separate layer between the edge and the cloud, processing various tasks at this position. This application placement depends on various aspects like purpose [46], energy consumption [47] or availability [48], but every installation impacts the position of a capture process as well as the analysis of the data. * **Lack of centralized capture positions** The environments consist of a large number of distributed computing resources, which we coined as spatial dispersion when introducing the field of investigation. This makes it challenging to have a centralized position to capture all relevant network traffic for the subsequent analysis of the data. This lack of centralized access makes it difficult to collect the entire relevant network traffic from all involved devices, especially as not all traffic is transported to the cloud. * **Limited storage and processing capabilities** Edge and fog devices often have limited storage and processing capabilities compared to traditional servers. This limitation affects the amount of network traffic data that can be captured and stored for forensic analysis. It may be necessary to prioritize and filter data to reduce storage requirements, potentially leading to the loss of valuable forensic evidence (and/or incomplete capture). Edge servers typically provide higher storage capacities, but the access to these areas is typically limited to specific interfaces and APIs. As a result, the capture process has to be performed at a point inside the network that is suitable to collect all relevant traffics at once; the use of the devices for storing the captured data is not possible. This is a common problem in advanced network forensic investigation as discussed in [49]. * **Inherent dynamic** Fog nodes as well as edge end points might join or leave the network dynamically. This dynamic behavior results in similar challenges as discussed in [2] inside virtual networks. As a result, an installed capture process is threatened for missing network packets because of new or undetected, but relevant devices (so-called incomplete capture). Investigators need to adapt their techniques to handle the frequent changes in network topology and availability of fog nodes. * **Data fragmentation and encryption** Nodes may perform data processing and aggregation, leading to data fragmentation and encryption. The problem of fragmented or encrypted data is a well-known problem in networks nowadays, which hampers the analysis of network traffic [50; 51]. The encryption of network traffic is a common practice to prevent the plain text transmission [52]. If used, eavesdropping of the connection is still possible, but analyses like application identification or usage are hampered [53]. The analysis of these encrypted data is part of current research like [54; 55]. The fragmentation of network traffic depends on the maximum transmission unit (MTU) of a network path. Routers inside a network set their own MTU if needed, which results in smaller network packets than initially sent [56]. The reconstruction of the fragmented network traffic has to be performed at the receiving side, so a packet capture process has to take care of collecting all fragments of the transmitted data. Otherwise, such an incomplete capture might led to the failure of a forensic analysis. * **Trust and privacy concerns** Fog environments involve multiple stakeholders, including device owners, fog node operators, and cloud service providers. This distributed nature raises concerns about trust and privacy. Investigators may encounter difficulties in accessing and retrieving data from different entities due to legal, privacy, and permission-related issues.