22.4 Summary

As investigators learn about new technologies, it is useful to think about how they will affect routine aspects of investigations such as alibis. With people spending an increasing amount of time using computers and networks, there are bound be more alibi's that depend on digital evidence. Computers contain information about times and locations that can be used to confirm or refute an alibi. However, digital evidence can rarely prove conclusively that someone was in a specific place at a specific time. Remember that IP addresses are associated with computers - not individuals. Therefore, an accomplice could help a criminal fabricate an alibi using the criminal's computer. Also, some computer times can be changed to corroborate an alibi. By following the cybertrail, investigators might find a computer program that simulated an alibi or they might learn that the computer clock was changed at the time in question.

Though it is easy to change the time of a personal computer, many computers keep a log of time changes. Also, when dealing with computers on a network, it becomes more difficult to change computer times. When multiple computers are involved, changing the time on one will result in a notable inconsistency with others. Therefore, when examining an alibi that involves a computer or network, investigators should search log files for time inconstancies.