Chapter 24: Tools to Aid in Internet Activity Reconstruction

---

Overview

Forensic investigators are frequently asked to reconstruct the online activities of a suspect under investigation. Most important online activities can be generalized into two categories: electronic mail and web-browsing habits. E-mail has become one of the fastest growing forms of communication and one of the most common means for transferring information about people, places, and activities. Likewise, the emergent properties of online accessibility mean more people are using the Internet to conduct their business, whether legitimate or not. This chapter discusses the toolset a forensic analyst needs to use to reconstruct the online activity of a suspect’s machine. It also highlights the intricacies we have discovered during field testing.

---