# Challenges of Network Forensic Investigation in Fog and Edge Computing
## 4 Challenges
* **Limited forensic tools and standards** Traditional network forensic tools and standards may not be fully applicable to fog environments. Fog nodes and edge devices often have resource constraints, making it challenging to deploy and execute complex forensic tools. Additionally, there may be a lack of standardized protocols and procedures specific to fog environments, hindering interoperability and consistency in forensic investigations. * **Time synchronization and clock drift** Fog devices may have different clocks and varying levels of clock accuracy. Inaccurate time synchronization and clock drift can complicate the correlation of network events across fog nodes, affecting the accuracy and reliability of forensic investigations. * **Jurisdiction** The distribution of edge and fog devices might result in installations all over the world. As a result, different laws and jurisdictions are relevant for the access of the network packets. This is a common problem in modern, globally spread environments with distributed virtual network endpoints [2]. Table 1 summarizes the challenges and assigns them to Phases 3 and 4 of network forensic investigation, as the first two phases and the last phase of the OSCAR methodology (see Section 2.2) are rather non-technical. The collect phase is split into its parts, capture and record. Addressing these challenges requires the development of specialized forensic techniques and tools designed specifically for edge and fog environments. The packet capture and subsequent analysis of these data depends on the accessibility of the network traffic, typically performed near to the source of the data. Thus, integration of approaches like [39] into network forensic processes, even if those often focus on the edge network itself, are necessary. Yet, the distribution of the devices hampers these steps and therefore the entire network forensic investigation. In addition to this, the variety of edge devices and the inherent diversity of network connections and interfaces increase the complexity. Accessing the fog devices can improve this situation, because it reduces this variety and leads to reduced data size because of previous aggregation on the communication path, but may result in incomplete captures if the communication of the edge device happens alongside the fog device directly to different communication partners. Figure 3 shows the difference between the different capture positions and the accessibility of the network traffic of the data sources. Whereas a capture process on Position 3 captures only the traffic of one edge device, Capture position 2 is able to collect the traffic of three edge devices and the edge server itself. Capture position 1 is able to collect the majority of the network traffic, but does not see network traffic between the edge device and the server if it is not forwarded into the cloud. Network forensics in fog and edge computing also necessitate collaboration between different stakeholders to establish guidelines, standards, and legal frameworks to facilitate effective network forensic investigations in fog environments. Despite these paths to better solutions, a number of open problems and challenges remain. The application-centric design of edge and fog infrastructures leads to various improvements and changes in the existing network designs. A possible improvement is the installation of edge servers, each aggregating data from a smaller subset of edge devices, based on various parameters like energy [57], response time [58] or overall profit [59]. Even artificial intelligence (AI) as a state-of-the-art technique is used in the field of edge and fog computing to find the best design or to improve the installations [60; 61]. Thus, the design is becoming more dynamic and unpredictable, because the decision process is blurred. As a result, the proposed improvements of tools and techniques to a distributed design is faced with a new level of possible changes and reconfigurations based on AI [26; 62].