NCJ Number
204066
Journal
Law Enforcement Technology Volume: 31 Issue: 1 Dated: January 2004 Pages: 62,64,66
Date Published
January 2004
Length
4 pages
Annotation
This article explains how to identify the sender of an e-mail that is in some way associated with the commission of a crime.
Abstract
The identification of an e-mail sender essentially involves understanding the nature of and how to obtain an e-mail author's Internet protocol (IP) address. An IP address, which is a 32-bit numeric address written as four numbers separated by periods, is assigned by an Internet service provider (ISP) each time an ISP client comes on to the Internet. The key for investigators is that most IP address assignments are logged by the ISP and kept for a limited period of time. An investigator needs to determine the IP address used at the time the e-mail was sent, find out which ISP issued the IP address, and subpoena that ISP to identify the user with that IP address on the date and time the e-mail was sent. Finding the IP address in the e-mail involves examining the headers that are part of the packaging of every e-mail sent. Headers must be read and interpreted to find out which is the originating IP address. For experienced computer investigators, this is a routine procedure that uses utilities familiar to the investigator; however, for most investigators, appropriate software is needed. Such software is named eMailTrackerPro and VisualRoute. eMailTrackerPro enables an investigator to track the route of an e-mail from its point of origin to its final destination and everywhere in between. When used with VisualRoute, an optional integration product, eMailTrackerPro can provide enough information to file a subpoena and ultimately identify a user. This article describes a case that involved the identification and location of an e-mail sender who had enticed a young girl he met on the Internet to meet him in person.