DHCP-Geotimeline Fo...
 
Notifications
Clear all

DHCP-Geotimeline Forensics

14 Posts
5 Users
0 Likes
673 Views
RolfGutmann
(@rolfgutmann)
Posts: 1185
Noble Member
Topic starter
 

In a case of a suspect we had the geofence-area of movement but were unsure about the timeline of places. As this case happend in-city we started to contact store owners about their in-store WiFi DHCP logs as we had the suspect's mobile WiFi MAC address. It came out that the store owners very differently log the DHCP activities as they also have different lease times. But after collecting tiny bit by bit we got a DHCP-Geotimeline to see where the suspect moved.

As this was without cell site analysis we had the impression to share this for the good.

 
Posted : 27/06/2017 3:49 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

In a case of a suspect we had the geofence-area of movement but were unsure about the timeline of places. As this case happend in-city we started to contact store owners about their in-store WiFi DHCP logs as we had the suspect's mobile WiFi MAC address. It came out that the store owners very differently log the DHCP activities as they also have different lease times. But after collecting tiny bit by bit we got a DHCP-Geotimeline to see where the suspect moved.

As this was without cell site analysis we had the impression to share this for the good.

I am actually more surprised about how seemingly you got those logs "easily", if at all.

jaclaz

 
Posted : 27/06/2017 6:11 pm
RolfGutmann
(@rolfgutmann)
Posts: 1185
Noble Member
Topic starter
 

People often are very cooperative if they have the impression they can help law enforcement but it can be based on the general attitude against the police in a specific country/region. The IT guys did very fast understand and handed out the syslogs.

I am not sure if ordinary people recognize that every WiFi and the respective DHCP handshake DORA process will log their MAC addresses 'you were here at this time'…

DHCP is my friend.

 
Posted : 27/06/2017 9:00 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

People often are very cooperative if they have the impression they can help law enforcement but it can be based on the general attitude against the police in a specific country/region. The IT guys did very fast understand and handed out the syslogs.

I am not sure if ordinary people recognize that every WiFi and the respective DHCP handshake DORA process will log their MAC addresses 'you were here at this time'…

DHCP is my friend.

It's not about being friendly, it is about liability (of course it depends on the specific Laws, both related to internet and Wi-FI and Privacy).

Besides, it is not so common that "store owners" actually have properly trained "IT guys" and that they actually keep "sane" logs.

On the other hand, if they are properly trained, very likely they would require something more than a smiling LEO asking nicely for the logs.

jaclaz

 
Posted : 28/06/2017 2:28 am
RolfGutmann
(@rolfgutmann)
Posts: 1185
Noble Member
Topic starter
 

LEO brings papers signed by state attorney, that helps a lot.

 
Posted : 28/06/2017 3:53 am
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

LEO brings papers signed by state attorney, that helps a lot.

Sure ) , but "obtain and serve shop owners a Court (or however High Authority) issued discovery warrant (or similar)" is usually not summed up as "contact shop owners".

From what you wrote it seemed like everyone was eager to comply to a simple request asked (kindly) by the (smiling) LEO, that was the part that was perplexing to me.

jaclaz

 
Posted : 28/06/2017 1:11 pm
RolfGutmann
(@rolfgutmann)
Posts: 1185
Noble Member
Topic starter
 

I accept your feisty and bossy character. Interpretation is free for everybody but I just feel bound by words and feel not responsible for what is read between (no) lines. A limited time budget and amount of words can only transport a limited amount of information but not the context in detail. Your approach is accepted but dont forget Everbody is different - what is an enrichment and not negative assumption.

 
Posted : 28/06/2017 2:21 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

Naah,
it is just a minor omission in my synonyms dictionary 😯 where for "to contact about" there is no entry meaning "to serve a Court order".

Even now it is not clear (at least to me) if you actually were offered the logs "voluntarily" or however got them upon simple request or if you had to use the "papers signed by state attorney".

jaclaz

 
Posted : 28/06/2017 4:23 pm
(@badgerau)
Posts: 96
Trusted Member
 

Rolf, thanks for sharing. A novel approach for a "digital age" investigation.

I think Swiss citizens would be more accomodating to Law Enforcement than some other countries.

 
Posted : 29/06/2017 2:08 am
MDCR
 MDCR
(@mdcr)
Posts: 376
Reputable Member
 

People can be cooperative if you just ask them - especially if they share your ideals.

Sometimes of their own free will, they can even contact you with information.

 
Posted : 29/06/2017 11:27 am
Page 1 / 2
Share: