Who did it? Sometimes the answer is in the file itself; at other times, in the records of a provider that only hands them over under court order. The examination shows which route the case allows and prepares each one.
Who is behind an anonymous profile, a fake e-mail or an unauthorised access? There are two technical routes, and they should not be confused.
In the first, the trace of authorship is in the material itself. A digital document holds metadata: who created it, in which program, on which computer, when it was saved and edited. An e-mail holds in its header the servers it passed through. A system records which account carried out each operation. The examination reads those traces and says what they demonstrate.
In the second, the trail leaves the victim's environment and ends at an IP address. Who was using that connection, at that instant, only the provider knows. Under the Marco Civil da Internet (Brazilian Internet Civil Framework, Law 12,965/2014), the provider is only required to hand over those records under a court order (Law 12,965/2014, art. 10, § 1º). That is the court order for subscriber and connection data. Here the examination supplies the technical elements so that the police, or the company's lawyer in court, request the right data and identify the holder of the connection used in the fraud.
When the material is available, authorship starts with it. The examination does not accept an isolated field as proof. Metadata can be edited. That is why each trace is checked against others, from independent sources, and inconsistency between them is also a finding.
Text files, spreadsheets, PDFs and images record author, organisation, program, internal creation and editing dates and, sometimes, the user and machine names. The examination extracts those fields from the preserved copy and compares them with the file system and with other versions of the document.
The header shows the real path of the message, the relay servers and the time of each hop. The sending domain's digital signature (DKIM), when present, indicates whether the message really left the server it claims to have left.
Application, VPN and directory logs show which account did what, from which address and at what time. Cross-checked against shift rosters and equipment use, they narrow the universe of possible people.
An IP address identifies a connection, not a person. To reach the holder, one must request from the right provider the right records, for the right period. The Marco Civil requires the application to the judge to set out well-founded indications of the unlawful act, the justification for the usefulness of the records and the period they refer to (Marco Civil, art. 22, sole paragraph). All three points depend on technical grounds.
Adriano Vallim prepares those grounds. The law firm applies in its pleading the information the examination identified. When the provider responds, the examination cross-checks the data returned with the events of the case.
Application access logs, connection logs and subscriber registration data. A vague request comes back incomplete. An overly broad request is denied or delayed.
The application provider (e-mail, social network, platform) reports which IP the access came from. The connection provider, identified from the registration of the address block, reports which subscriber was using that IP. As a rule there are two steps, and the second depends on the precision of the first.
Many providers put hundreds or thousands of customers behind the same public IP, each in a range of ports. Without the source port, the carrier can only answer with the list of everyone who was using that IP at that moment.
Servers usually log in UTC (universal time, three hours ahead of Brasília), and carriers answer in Brasília time. Three hours badly converted point to another subscriber. The examination also measures the clock drift of each system.
The connection provider must keep its logs for one year. The application provider, as a rule, for six months (Marco Civil, arts. 13 and 15). The police or administrative authority and the public prosecutor may request that retention be extended (Marco Civil, arts. 13, § 2º, and 15, § 2º). A late request may find the record already discarded.
The victim can arrive at the police station with only a police report, or with authorship and materiality already demonstrated. The forensic dossier for the authorities makes that difference. It is a criminal complaint with a technical basis.
In publicly prosecutable offences, the Code of Criminal Procedure allows anyone to bring to the public prosecutor written information on the fact, the authorship, the time, the place and the elements of conviction (CPP, Brazilian Code of Criminal Procedure, art. 27). The dossier organises exactly that:
The dossier does not replace the investigation: naming the perpetrators and requesting precautionary measures is for the authority. The examination delivers the technical route.
A company that came third in a public tender sought to have the procedure annulled. It filed with the court digital evidence of the alleged fraud.
The examination demonstrated that the evidence had been produced with a tampered browser. The metadata of the forged material pointed to who created it.
The alleged fraud did not exist, and the authorship of the false evidence was demonstrated. The winning company was able to perform the services.
A company suffered a fraud through intrusion into its systems, and Adriano Vallim acted as party-appointed expert. The accesses came from a few IP addresses, and the carrier's records showed that each was shared by thousands of mobile lines.
The examination cross-checked those records against the time of each event of the attack and kept only the lines active on those IPs at the right instants.
In the final phase around 300 suspects remained. The company did not keep the source port of the accesses, and without it there was no way to single out the perpetrator. The case shows the value of a forensic audit done before the incident, described in Corporate Investigations and Compliance: it checks whether the company's logs will allow authorship to be established.
See also
Corporate Investigations and Compliance → Anti-Forensics and Destroyed Evidence → Financial Fraud and Payment Systems Forensics → Cloud, Identity and DevOps Forensics → Digital Questioned Document Examination → Judicial and Extrajudicial Expert Work → Digital Law and Technology →
Before deciding, it is worth seeing what has already come through this laboratory: cases described without identifying the parties, in the format of challenge, method and result.
The intruder's control channel was written into smart contracts. The examination decoded what he had deleted and handed the authorities concrete routes to identification.
See the case Negative proofThe official examination had concluded that he took part. The re-examination showed the links were false positives, and the accused person was cleared.
See the case