Chapter 11
Digital Evidence as Alibi
On completion of this chapter, the student will:
– Recognize that key pieces of information in an alibi are: time and location.
– Be aware of potential sources for time and location information.
– Be aware that, when corroborating an alibi in,
With people spending an increasing amount of time using mobile devices, computers, and
networks, there are bound to be more alibis that depend on digital evidence.
Multiple Choice Questions
1. Investigators should not rely on one piece of
they should look for an associated _______.
2. Types of digital evidence that might corroborate an alibi include:
3. It is unwise to rely only on a recovered IP address because:
4. It is quite difficult to fabricate an alibi on a network successfully because:
5. It is important to gather as many sources of supporting evidence as possible because:
6. To demonstrate that someone is lying about an alibi, it is necessary to:
7. In confirming an alibi involving an obscure piece of equipment, if no documentation is
available, the manufacturer is no longer in business, or the equipment/network is so
complicated that nobody fully understands how it works, you should:
True or False Questions
1. Absence of evidence refutes an alibi.
2. When investigating an alibi that depends on digital evidence, the first step is to
assess the reliability of the information on the computers and networks involved.
3. It is not difficult to fabricate an alibi on a network successfully.
4. Investigators can rely on one piece of digital evidence when examining an alibi.
5. Computer networks can contain a large amount of information about times and
locations.
6. Credit card companies are not permitted to keep records of the dates, times, and
locations of all purchases.
7. Telephone companies keep a record of the number, the time and duration of the
call, and sometimes
8. With people spending an increasing amount of time using mobile devices,
computers, and networks, it is very likely that more alibis will depend on digital
evidence.
9. It is not easy to change the time on a personal computer.
10. Digital evidence can rarely prove conclusively that someone was at a specific
place at a specific time.
Essay Questions
1. Discuss the reasons why a digital investigator w
Scenario
A suspect claims that evidence artifacts found on his computer were placed there by his
estranged wife out of malice. As evidence, he points out that the created dates on some the files
occurred when he was on vacation.