Chapter 22: Digital Evidence as Alibi

Overview

The key pieces of information in an alibi are time and location. When an individual does anything involving a computer or network, the time and location is often noted, generating digital evidence that can be used to support or refute an alibi. For example, telephone calls, credit card purchases, and ATM transactions are all supported by computer networks that keep detailed logs of activities. Telephone companies keep an archive of the number dialed, the time and duration of the call, and sometimes the caller's number. Credit card companies keep records of the dates, times, and locations of all purchases. Similarly, banks keep track of the dates, times, and locations of all deposits and withdrawals. These dates, times, and locations reside on computers for an indefinite period of time and individuals receive a report of this information each month in the form of a bill or financial statement.

Other computer networks, like the Internet, also contain a large amount of information about times and locations. When an e-mail message is sent, the time and originating IP addresses are noted in the header. Log files that contain information about activities on a network are especially useful when investigating an alibi because they contain times, IP addresses, a brief description of what occurred, and sometimes even the individual computer account that was involved. However, computer times and IP addresses can be manipulated, allowing a criminal to create a false alibi.

On many computers it requires minimal skills to change the clock or the creation time of a file. Also, people can program a computer to perform an action, like sending an e-mail message, at a specific time. In many cases, scheduling events does not require any programming skill - it is a simple feature of the operating system. Similarly, IP addresses can be changed, allowing individuals to pretend that they are connected to a network from another location. Therefore, investigators should not rely on one piece of digital evidence when examining an alibi - they should look for an associated cyber-trail. This chapter discusses the process of investigating an alibi when digital evidence is involved, and uses scenarios to demonstrate the strengths and weaknesses of digital evidence as an alibi.