Investigating Researching and Gathering Evidence

Pedophiles use the Internet to prey on the innocent young generation. A person whose kid has been a victim to the pedophiles has come into contact on how convicting such people can be challenging if evidence is not properly collected. Some other members of society are victims of the pedophiles too; pedophiles make payments online using stolen credit card information to cover their tracks. Cybercrime is a threat that is only begging to gain shape given the number of gadgets that make the internet of things (IoT). Steps that can be taken to collect, preserve and transport digital evidence have been looked into in this paper. The work of a cybercrime prevention officer will be rendered futile if such officers do not work together with forensic officers specialized in digital data. Not every cybercriminal will get prosecuted for their offenses as they can easily encrypt or destroy incriminating data. So far, the deep web has been a haven for many pedophiles.

Keywords:

Pedophiles, IoT, Encryption, Decryption, Deep web, Internet protocol, identity theft

Internet crimes are multiplying due to the increase in the number of items that make up the internet of things which has made the commission of crimes rampant. Pedophiles use stolen credit card numbers to receive and make online payments online. There is the deep web where criminals have established online stores where selling of compromised credit cards takes place (Bradley, 2004). Some software that is used in the aiding of pedophile activities is obtained from the deep web.

Security agencies have set up special units to deal with internet crimes due to the growing number of internet users every day; the FBI has the Violent Crimes against Children section that deals with crime.

Earlier this year, Brian K. Hendrix, a Tennessee man was sentenced to 21years in prison after being adjudicated guilty of child pornography. Brian was the owner of two websites from which he lured children to perform acts that he recorded secretly to share with other pedophiles. Accomplices of Brian were too arrested and got sentenced with sentences ranging between 18 and 21 years. All the accomplices of Brian were engaged in exploiting children by exposing them so sex content that corrupted the children to act as they could be told by the predators (“Threat from Pedophiles Online is ‘Vast and Extensive’”, 2016).

The FBI has the best software that can be used to net pedophiles, but the hurdles are they would not share their tactics with the public, this is all for good reasons as the criminals may get a heads up to advance their techniques (“Threat from Pedophiles Online is ‘Vast and Extensive’”, 2016). A person privy to such technology of the FBI will rely on identifying the internet protocol address of a computer then track the computer across the web by the track left behind. However, pedophiles use virtual private networks to hide their tracks; but the messages sent to chat rooms can be tracked back to the machine from which it was authored, this way the pedophiles can still be caught (“Threat from Pedophiles Online is ‘Vast and Extensive’”, 2016).

Pedophiles can be engaged in identity theft directly by luring the victims of the card online or just buy from several outlets found in the deep web. In the deep web, several illegal things take place, selling of hacked PayPal accounts, compromised credit and debit cards selling even the sale of counterfeit bills and social security numbers (Bradley, 2004). Getting to know how the credit card details were obtained would demand to get to the real owner of the card to know when irregularities started occurring on his card history. Deep web criminals use crypto currency to make purchases and receive payments such that transactions cannot be traced back to them. A person found handling a compromised credit card will bear the cost of engaging in such activity on top of getting to know how the card was obtained. Good investigation techniques can get the criminal to disclose the source of the credit card.

Just like every house has an identifying number, every computer and phone connected to the internet has its unique address (Girard, 2013). Tracing an offender begins by identifying the internet provider of for they have logs of the date, time, account user information and an automatic number identification assigned to every user at the time of connection. However, logs are kept for a limited period depending on the policy of an internet service provider.

Identification of online criminals begins at resolving of the domain name of the website that is engaged in the commission of a crime. There are commercial software tools available that can help decode the name of a website to an internet protocol address (Hagy, 2010). The second stage is the determination of name registration details. It is at the second stage that the details of the website owner which include name, billing information and contact can be found. The owner of the website can then be served with legal processes to serve the relevant authorities with details of a certain user who was on the website at a known date; it is the responsibility of website owners by law to keep details of its users (Hagy, 2010). On matters concerning the deep web, it would be almost impossible for a person to track anyone as the Tor network is highly secretive.

Communication made on the internet has to use an internet protocol; to be successful in online crime investigation; the internet protocol address must be traced to its source.

Every email sent from a device contains two parts, the header, and body. The header varies from one computer to another; the header contains information that can be traced back to the specific computer from which the message originated (Hagy, 2010). Every computer or gadget that handles an email adds identification information of that computer to the header. Even if an email is forwarded across several computers, the author of the message can still be found by decoding the information contained in the header. However, the outlined criteria of knowing the sender of an email will work as long as the sender of the email does not use anonymizers to deliver the email; anonymizers strip the email all the identifying information that contained in the header of an email (Hagy, 2010).

Most common used technique in catching pedophiles that hide in chat rooms is to pose as the potential victim. Posing as a potential victim will make the work easier for the law enforcers to cut on the expensive and advanced technology used in tracking offenders (Hagy, 2010). Offenders will disclose their locations or put up a meeting with the victim; through this law, enforcers can swing into action to capture the offender at the meeting point. The offender may be tempted to ask for a phone number to call the victim, and if the offender makes a call, the location of the offender will be disclosed.

Before an investigative officer can obtain a search warrant to enter the premises of a suspect, the officer must conduct enough research on the suspect such that if that evidence is brought to court, the court will satisfied that there is a case against the suspect and if a search warrant is not issued it would be an impediment to justice (Girard, 2013). In the absence of a search warrant, the investigator should ensure that evidence obtained is admissible in a court of law. The investigator should keep the investigations process within the confines of the Fourth Amendment, Electronic Communications Privacy, Pen Register and Trap and Trace Statute, Title III wiretaps, and any other state laws (Hagy, 2010).

Investigating officers obtain search warrants by swearing affidavits showing probable cause why a search warrant may be issued. The affidavit is presented to state attorney or duty court for certification (Hagy, 2010). A search warrant may include the manual search of premises or installation of a tracking device on the target’s property.

Digital evidence has to be carried in a storage device. The storage device to be used can be that of the victim or the investigating officer’s device. Many at times investigators carry the suspect’s device as it may help solve puzzles in the investigator’s theory that linked the suspect to the crime being investigated. A computer that is on should be left as it is and embark on the collection of data from the device. If a phone is the subject of the investigation, it ought to be kept in a static bag to avoid remote access of the device (Hagy, 2010). Devices thought of containing digital data are to be transported in cartons and that are shock proof in case a vehicle hits a pothole, or runs into another automobile. Once data is collected from the suspect’s computer, the data should be kept in a device that cannot be accessed remotely (Girard, 2013). Digital evidence should be kept away from magnetic fields especially those produced by radio transmitters and speaker magnets (Girard, 2013).

Deletion of a file does not necessary delete the file data. Deletion is the change of a files’ MTF entry header and metadata files. Recovery of deleted files involves, parsing all files and storing of the flag bit information of the deleted file. Secondly, all files are sorted out by address space (Girard, 2013). Flag byte will help locate the deleted file during analysis of files. A deleted file may be beyond recovery or can still be recovered. A file that is partly covered by adjacent two files, the file is safe for recovery; one that is completely covered is non-recoverable (Girard, 2013). This procedure is done by specialized forensic officers or by using specialized software.

Criminals encrypt their data to protect the access of information that may be injurious to their cause. There exists software in the market that is used in the encryption process. Normally the buyer of the encrypting software will be prompted to enter a key that would be used to decrypt the files; this is like any other password a person can use to protect themselves. Encryption software scrambles the contents of computer files such that they cannot be accessed without a key (Girard, 2013). In instances where the key is not stored in the computer and the suspect cannot give the key such data is unrecoverable. Forensic officers can easily locate the decrypting key of files depending on the software used to encrypt.
The collection of digital data entails an understanding of what data is to be collected and what are the steps to be taken to access such data. The people of America are protected by several laws that it is proper for the investigating officer to understand before embarking on the collection of evidence. Digital evidence is delicate and ought to be kept in a safe place away from magnetic fields. An investigating team should be well versed with the recovery of deleted data as criminals are prone to delete data to cover their tracks. Some suspects can go to the extent of encrypting data stored in their computer thus the necessity to have a team of forensic officers that can help in such situations. From the study, having competent forensic officers is an added advantage but not an assurance that all data deleted and encrypted can be recovered, there are limits to which data can be recovered under each category.

References

Bradley, R. (2004). Science, Technology, and Criminal Justice (Vol. 4). Peter Lang.
Girard, J. E. (2013). Criminalistics: Forensic science, crime, and terrorism. Jones & Bartlett Publishers.
Hagy, D. W. (2010). Investigations involving the Internet and computer networks. DIANE Publishing.
Threat from Pedophiles Online is ‘Vast and Extensive’. (2016). Federal Bureau of Investigation. Retrieved 22 November 2016, from https://www.fbi.gov/news/stories/threat-from-pedophiles-online-is-vast-and-extensive