Trojan defence: A forensic view

The Trojan defence; “I didn't do it, someone else did” - myth or reality? This two-part article investigates the fascinating area of Trojan & network forensics and puts forward a set of processes to aid forensic practitioners in this complex and difficult area. Part I examines the Trojan defence, how Trojan horses are constructed and considers the collection of volatile data. Part II takes this further by investigating some of the forensic artefacts and evidence that may be found by a forensic practitioner and considers how to piece together the evidence to either accept or refute a Trojan defence.