Chapter 1: Introducing Network Forensics

1. A filter on the ftp will provide all types of FTP packets while ftp-data will provide packets containing transferred file contents
2. Yes, http.contains keyword for the webpages
3. Yes, but it is difficult to do so