Abstract:
Software-Defined Networking (SDN) is an evolutionary networking paradigm that offers simplified and agile network configuration and management capabilities. However, embracing this new and futuristic paradigm requires the understanding of Digital Forensics (DF) limitations that it presents. Studies show that the dynamism of SDN architecture impedes the preservation of Potential Digital Evidence (PDE) during a Digital Forensic Readiness (DFR) process. Therefore, the identification and acquisition of viable PDE in SDN platforms largely depends on the thorough understanding of the issues and challenges affecting the application of DFR in SDN platforms. For this reason, this study leverages a case study research methodology to empirically underline the forensic limitations and provide level of specificity with which these limitations affect the DFR process. The results of the case study combined with existing literature are used to expose the issues and challenges in a typical SDN testbed. The knowledge acquired from the state-of-the-art with respect to conducting DFR in an SDN platform addresses the knowledge gap of understanding these limitations.
