Forensic evidence collection normally occurs after the security breach, crime or event of interest. With Network Forensi

[answerhappygod]

Forensic evidence collection normally occurs after the
security breach, crime or event of interest. With Network Forensic
Analysis Tools (NFATs) in place, it helps administrators monitor
their environment for abnormal traffic, perform forensic analysis
and get a clear picture of their environment.
a)At the beginning of developing network forensic tools,
developers have faced certain challenges. State the challenges.
?
b)Briefly describe the capabilities of NFATs compared to other
security tools. ?
c)State TWO (2) basic types of NFATs used to collect network
data/traffic. Briefly elaborate some pros and cons each of the
types of NFATs.?