The Global Cybercrime Ecosystem and Cybercriminal Investigation 325
The ability to perform this kind of time-based analysis will depend on vari-
ous system management policies. Each policy has to be understood by the inves-
tigator when nding if a trace could still be collected somewhere in the system.
For the physical location of relevant traces, the position of the author is not
sufcient to limit the area of investigation. An information system connected
to the Internet can be distributed between many locations. For instance, when
server management is outsourced, the data are often stored on a server situated
in a remote facility.
To reach this location, even from inside the enterprise, a criminal will nec-
essarily use the infrastructure ...