Unit 6 Tracking Internet Crime

Tracing In general, is also going to be one of the easiest forms to track and trace. service providers plan for and provide online mailbox storage of the messages, usually for the sender and the recipient. Secondly, messages have the source and destination information encoded right into them to ensure proper routing. This encoded addressing scheme is usually not seen by the average user.

Contd’ Most users generally only see lines such as To:, From:, Re:, and the date. This information is commonly referred to as brief headers. Behind the scenes in the full header (i.e. full headers), the actual message routing code is present. When someone views the full header, he or she can examine the source and destination information in its entirety. Additionally, as the message travels across the Internet, it will pass through other computers (routers) as it travels to the recipient. Each routing server or other PC it touches will generally also add code to the header with the IP address of the server and a timestamp for when it passed through that system.

Beginning the trace It would stand to reason that the first step in tracing any would be to examine the full header. There is one prior step that should be taken, however, as is the case with all other digital evidence. To ensure that we do not modify, alter, or destroy digital evidence, it should be standard operating procedure to first make an exact digital copy or clone of the evidence, or, in this case, the message. In some major cases this will mean cloning an entire hard drive. In the case of a lower-level case, it could mean simply saving the to a disk or other storage device, such as a USB key. Some jurisdictions may have adopted their state’s harassment statute as a municipal ordinance violation.

Tracing Contd’ Once we have ensured the safety of at least one exact copy, we can then begin to analyze an evidentiary copy. In our evidence copy, then, the first step is to analyze the full headers of that address. Most programs by default only display the brief headers (To, From, RE:, Date, etc.), but all types of , including web-based such as Hotmail ® and Yahoo! ® mail, can be set up to display the full headers by selecting that option.

Tracing Many lines of data, including names of servers, addresses, IP addresses, and timestamps. The investigator will need to go through this material in chronological order to see how the message traveled. Generally speaking, we will work from the most recent timestamp (the recipient) backwards to the oldest timestamp (the sender). The first timestamp occurred when the sender hit the send button on his or her application and the message first touched the server for the sender’s Internet service provider. This will list the IP address the sender’s personal computer had at the time it connected and sent that message.

Working Backwards The next IP address and timestamp in the line will generally be the IP address of the sender’s Internet service provider’s server. The third will usually be the server of the recipient’s ISP. The final IP address will be the IP address that was assigned to the recipient’s computer at the time that the recipient got the message from the ISP server to his or her PC. Once an investigator has isolated the IP addresses and timestamps in the full header of an , the next step is to verify who is responsible for that IP address.

On the Internet, domain name information and IP address information can be tracked using a WHOIS query. There are many agencies that are responsible for the sale and registration of IP addresses and domain names. One of the most wide-reaching agencies is the American Registry for Internet Numbers (ARIN), which can be accessed by going to Investigators can type any domain name or IP address into a WHOIS search function, and the databases of the registry will give them registration information, including what company owns or maintains a given IP address or range of addresses.

The easiest scenario would be the case where a user has his or her Internet service and accounts with the same company. Many users will, however, have many different accounts, used for different purposes. It is not uncommon for one person to use the cable company for Internet connection, have an address through their cable company, and have several separate address accounts with online mail providers such as Yahoo ®, and Hotmail ®.

Once the responsible provider and Internet service provider have been determined, the investigator can draft a subpoena for records from the companies. Some companies can be served with the subpoena at the mailing address provided in their WHOIS search results. Other companies have different procedures, ranging from very strict procedures, such as AOL™, to more lax approaches. AOL subpoenas and search warrants have to be served locally in Virginia. Some other companies will accept a fax of the document and begin processing the request immediately. Each company should have a designated point of contact for questions regarding subpoenas and search warrants.

Instant Messaging & Chat Instead of waiting for a user to receive, open, and read an message before responding, two users can meet online to type text back and forth to each other in real time. Extremely fast and is limited only by the distance the electrical impulses have to travel between users. Even users on opposite continents might only see a delay of a few seconds, hence the name “instant messaging.” There are various types of instant messaging, including personal messaging and chat rooms. One of the most popular versions of IM is ICQ, which is slang for “I seek you.”

Investigative Challenges Instant Messaging, VOIP, and video conferencing investigations all have one major hurdle and several smaller problems to overcome. Records of these conversations are only kept for a very short time by Internet service providers. Service providers can literally have millions or billions of instant messages per day pass through their servers. They simply do not have enough storage capacity to store them all for any length of time.

Challenges Contd’ Secondly, it takes very little information to sign up for an account or instant-messaging service. One can literally sign up for a screen name with completely bogus information, and signing up may only take a few minutes. A user could easily create dozens of online profiles in an afternoon. The only information someone might have about someone who communicates with him or her via IM is the sender’s screen name or address. It becomes much harder, therefore, to trace back an instant communication to the person sending it. Time is not on the investigator’s side.

Timely Investigative Options Once the screen name or address of the sender is determined, a subpoena for records can be drafted to get all records the company has on the person with that name or address. Investigators should again pay close attention to the time and date of the offending communication. If they can narrow that down, the company might have a record of what the offending user’s IP address was at the time the message was sent. Investigators can WHOIS that IP address to determine what Internet service provider the offender was using and subpoena name, address, and billing information from that Internet service provider. A confirmed could also be sent to verify the user’s IP address.

Records Unless a violation is immediately reported and immediately investigated, there may be little an investigator can go on. One piece of good news, however, is that many instant messaging programs save logs or transcripts of all chat sessions right on the victim’s PC. Some have this feature enabled by default, while others require the user to specifically turn on that feature. During a child enticement investigation it will clearly document conversations between the victim and offender, and may even contain specific statements of the offender’s criminal intent. Can be on the victim’s PC, the suspect’s PC, or both.