Forensics / Evidence / Discovery

Let's assume that one wishes to learn how to contact an author or those responsible for online content or an online site. There are a number of ways to attempt to achieve this, ranging for easy to difficult.

Contact Us: Many sites have either "About Us" or "Contact Us" links on their website which will tell you who they are and how to contact them (don't forget to look for a copyright statement which may tell you who the owner of the content is - there may also be a DMCA statement with a point of contact for copyright concerns). This would be the easy method.

WHOIS: If the site has its own domain name, the owner of the domain name can be uncovered by using WHOIS to query the DNS database. Type the domain name into WHOIS, and the response should provide you with the domain name owners name and contact information. In order to protect the privacy of domain name owners, some registries offer a proxy service which places the name of a proxy in the registration in place of the domain name owner's contact information. Other domain name records are simply filled with bunkum and have little valid information. This is a source of constant consternation for law enforcement officers. This tool will also not work if the individual in question's content is hosted on a third party company's site. For example, if one doesn't like what is on someone's Facebook page, doing a WHOIS lookup for "facebook.com" will provide you with information about Facebook and not about the individual posting the information.

Accounts: When individuals set up website or other online presences, they generally set up accounts with the host. Hosts generally like to get paid for their business and therefore their records may accurately reflect how to extract money out of the individual using their website. The problem is that Hosts may have privacy policies saying that they will not simply hand their clients information over to just anyone. except when in receipt of proper legal authority. Legal authority in a civil case may come in the form of a civil subpoena.

• Rule 45 Subpoena
• Rule 34 Producing Documents, Electronically Stored Information, and Tangible Things, or Entering onto Land, for Inspection and Other Purpose
• Zynga Game Network, Inc. v Williams et al, Case No. CV-10:01022JF(PVTx) (ND CA May 20, 2010)

In a criminal case, law enforcement officers may need to comply with the Electronic Communications Privacy Act.

Server Logs: Servers generally record the incoming IP addresses of computers (individuals) that are interacting with that server. Ask for a webpage, and the website may log your IP address. One issue which involves "data retention" is how long the site might retain that information. If one is able to gain access to server logs and uncover the IP address of the visitor, one can use reverse IP look-up to identify who the visitor is. Reverse IP look-up may only identify the network from which the visitor came. Knowing the specific IP address and the network to which that IP address belongs, one may be able to issue a subpoena to that network asking the network to match the specific IP address to the account that used that IP address at the day and time in question. A word of caution, however: as we move run out of IPv4 addresses and into the IPv6 transition, the network will increasingly be kludged with devices such as NAT boxes which may make it increasingly difficult to match a specific IP address to a specific individual. The P2P copyright litigations are filled with instances where plaintiffs have IP numbers of P2P users, and attempt to unmakes the individual behind the IP number.

Government

• Secret Service, Best Practices for Seizing Electronic Evidence linked from end of www.secretservice.gov/financial_crimes.shtml
• FBI Forensic Science Communications Journal
  • Handbook of Forensic Services (pdf)
• DoD Computer Forensics Laboratory
• US Secret Service Forensic Services Division
• DOJ
  • “Status and Needs of Forensic Science Service Providers: A Report to Congress”
  • DOJ Tracking a Computer Hacker, Daniel A. Morris, USA Bulletin (May 2001)
• NIST
  • PDA Forensic Tools:An Overview and Analysis, NIST 9/14/2004
  • NIST Computer Forensics Tool Testing (CFTT) Project Web Site
  • NIST Special Publication 800-61, Computer Security Incident Handling Guide., NIST 9/26/03
  • Draft NIST Special Publication 800-86, Guide to Computer and Network Data Analysis: Applying Forensic Techniques to Incident Response, NIST 8/12/2005

Resources

• Forensics
• IEEE/CreateNet Computer Network Forensics Research (CNFR) Workshop 2005
• Interop Network Forensics Day 2005
• Guide to Computer Forensics and Investigations Book Review 2004
• Network Forensics: Tapping the Internet O'Reilly 2002
• Good detective work means paying attention before, during, and after the attack. ACM Queue 2004
• CERT
  • First Responders Guide to Computer Forensics, CERT 6/10/2005
  • CERT: How the FBI Investigates Computer Crime July 2000
  • Carnegie Mellon University, Handbook for Computer Security Incident Response Teams

Tools

• Treachery Unlimited
• MoreNet
  • Looking Glass, IP BGP, IP Route, Trace, Route
• Ports
• Treachery Unlimited Port Lookup Search Results
• WHOIS

Laws

• PROTECT Our Children Act of 2008, Title II, recognized the needs to expands DOJ's CSI capabilities by expanding DOJ's computer forensics capacity - and DOJ gets to file an annual report on its expanded computer forensics capacity. $2m is appropriated for this
• The Adam Walsh Child Protection and Safety Act of 2006, Sec. 705, which called for Additional Computer-Related Forensics examiners, dedicated to investigating crimes involving the sexual exploitation of children and related offenses.

Links

• Immigration and Customs: Cyber Crime Center: Digital Forensics Section
• National Cyber-Forensics & Training Alliance a partnership of iC3, the National White Collar Crime Center, CMU, WVU, and Duquesne U.
• NIST Computer Forensic Reference Data Sets (CFReDS)
• US Secret Service Forensic Services Division
• DOE Cyber Forensics Center

News

• Cybercrime spurs college courses in digital forensics, USA Today 6/6/2006