Email & Instant Messaging Investigations & Tracking A DVD featuring Andrew Obuchowski, Jr.

Table of Contents

I. Internet Basics

1)       What is the Internet?

2)       Getting Online

3)       Internet Service Providers (ISP)

a)  Types of connections

4)       Internet Protocol (IP)

a)  Definition

5)       IP Addresses

a)  Static

b)  Dynamic

6)       DNS Records

a)  Examples

II. Instant Messaging Investigations

1)       File Transfer Protocol

a)  Web

b)  Dos

2)       Peer-to-Peer File Sharing

a)  Sharing files/music between

computers

b)  Download file from user(s)

c)  WinMx, Bear Share, ABC, Kazaa

3)       Chat

a)  Pedophile and XXX haven

b)  Public/private chat rooms

c)  Exchange files/photos

d)  Public profiles

e)  Instant Messaging (IM)

f)   Includes text, sounds, videos and 

 pictures

g)  Rooms frequently change

h)  Used to traffic in illegal activity

4)       IM: Recording & Investigating

a)  Step-by-step instructions to recording

and reporting

III. Email Investigations

1)       Email

a)  Most widely used

b)  Finding geographical location

c)  Most investigations involve email

d)  Hiding identity

2)       Email addresses

a)  Identifying  users

b)  Examples

3)       Post Office Protocol (POP)

a)  Protocol for receiving email

4)       Simple Mail Transfer Protocol (SMTP)

a)  Protocol for sending email

5)       Examples

6)       Tracing Email

a)  Original file needed

b)  Can’t forward email

c)  Some information is difficult to forge

d)  Must view full email header

e)  Examples

7)       Reading Email Headers

a)  Mail server distributes email

b)  Message may be passed to computers

hosting email before reaching destination

8)       Email Body Reading

a)  HTML email

b)  Links may be disguised

c)  See hyperlink address

9)       Anonymous Remailers &Proxy Servers

a)  Common practices of re-mailers

b)  Common practices of proxy servers

10)    Recording Email Evidence

 a)    Saving and printing email.

b)    Web based options

11)    Email Investigation Summary

a)  Locating originating IP address

b)  Finding information for IP address

c)  Sending preservation letter

d)  Government process for information

12)    Obtaining Information from an ISP

a)  Two important items for investigation

b)  Search warrant/subpoena necessary

c)  Multiple ISP’s/multiple suspects

d)    Dial-up ISP’s recycle IP addresses

13)    Simple Sites/Tools