Chapter 9: Identification of Data

---

OVERVIEW

The Internet—friend or enemy? The popularity of the Internet has grown at incredible rates and today it reaches into the hearts of many corporations and households worldwide. The Internet gives computer users access to a wealth of information. It is also a wonderful mechanism for the exchange of e-mail communications and file attachments globally. International boundaries no longer exist when it comes to the exchange of information over the Internet. This new technology has proven to be ideal for international commerce and has the potential to be a valuable communications tool for exchange of law enforcement and government information. However, the Internet also provides the crooks with communication capabilities that did not exist previously. Through the use of a modem and with just a few clicks of a mouse, criminals can share information worldwide. It is sad but very true. Cyber crime has become a reality in our modern world.

More and more, law enforcement agencies are encountering computers at crime scenes. These computers are used to store the secrets of criminals and are also used in the commission of crimes. Internet-related crimes are clearly on the rise and abuses of corporate and government Internet accounts by employees are becoming commonplace. For example, one recent case involved an employee of a large corporation. He was using his corporate Internet account, on company time, to run his side business. What a deal—thanks to the Internet, he had two day jobs. To make matters worse, he was also using the corporate computers on company time to view and download pornographic images from the Internet. In another case, a law enforcement management official destroyed his 15-year law enforcement career when he was caught using a law enforcement computer to download pornography from the Internet. Just recently, law enforcement officials in Herndon, Virginia were requesting help in the investigation of the rape of a young girl. The girl had been lured from an Internet chat room to meet the rapist at a shopping mall. When the rapist was finally caught, his computer contained crucial evidence in the case.

The law enforcement community is starting to effectively deal with computer-related criminal investigations. Funding is finally being focused on the creation of local and state computer crime units. Law enforcement training organizations such as the National White Collar Crime Center, Search Group, International Association of Computer Investigation Specialists, and the Federal Law Enforcement Training Center are training hundreds of law enforcement computer specialists each year. Some of these training efforts are being directed at Internet-related crimes and more training emphasis will be placed on this important technology issue in the future.

Now, let’s look at how keeping an accurate and consistent sense of time is critical for many computer-forensic-related activities such as data identification. In other words, being able to investigate incidents that involve multiple computers is much easier when the timestamps on files (identified data) and in logs are in sync.

---