The Internet is the computer: The role of forensics in bridging the digital and physical divide

Just as residue from the ridge patterns on our fingers existed before science and technology was able to ‘‘uncover’’ them by latent fingerprinting methods, digital traces of criminal activities exist on the Internet, and consequently lie dormant because we are only beginning to develop and deploy tools and techniques to identify, manage, and model solutions to probing questions related to digital crimes. Cyber forensic investigations occur in varying degrees throughout the fields of computer security and incident response, network forensics, and law enforcement investigations, yet in all contexts involve the recognition, recovery and reconstruction of investigatory leads and evidence. In the context of investigations, the source-artifacts for evidence and leads are often ‘‘siloed’’ into investigation data from structured law enforcement reports, or data from examinations of computers involved in a crime. No longer are artifacts relegated to data in reports, and no longer is the standalone computer exclusively a target or tool used in criminal activity. The Internet itself has become a breeding ground for primary and secondary sources of evidence in the search for truth, as well as harboring the seeds to predict future malfeasance.