Cyberbullying Investigations - what you need to know Part 1

Digital Evidence

When it comes to cyberbullying, often the only way to determine which student is behind the torment is through cyber-forensics. Unfortunately, a printout of the message or the post won’t help other than to record what was said. Anyone can alter a message to make it appear that the message was sent or posted by someone else. They can also break into someone’s account and send the message from that account. A printout won’t tell you that. Only the IP address used by the cyberbully can help determine who was really behind the attack.
 If a “cyberbullying expert” tells you that a printout can be used to help determine a cyberbully, or should be sent to the parents of the student whose account was used or apparently used to launch the attacks, run—do not walk—to another expert. Too many self-proclaimed experts have cost the target dearly when they find that the evidence they need is no longer available or was mishandled and the case is over. Every message sent or posted on the Internet works through a standard called Internet protocol or IP. It’s what makes the Internet work. It’s the IP you need, and to get it you need a law enforcement subpoena, a lawyer’s subpoena, warrant or a court order.

Most reputable networks have a former law enforcement officer working with their security team to assist law enforcement investigative teams. Many have special hotlines or email addresses just for law enforcement officers.

Facebook and other networks also collect MAC addresses of computers and mobile phone identifiers to help identify the devices used, as well.

Certain software, such as #Spectorsoft will also collect the IP addresses of instant messages, the content of a snapchat session, and if used on a mobile phone, identifiers from text messages.