showed that IP packets, Ethernet frames and other network related data is available in physical memory and these data can be retrieved from hibernation files or memory images. Additionally, the authors proposed the network carving algorithm, techniques and essential tools to identify and extract the information.