Computer Forensic !!!?

Question

how do thy identify tht this mail/virus/worm originated from this computer?? i mean wat is the unique identifier to a computer on the internet .. if u say IP .... please defed to the point " doesn't IP keep changing in case of dynamic IP ?? to change my IP all i have to do is to restart my sys isnt it ?? so how cud u identify the sys which keeps changing .. the IP today mine will be sum1 else on tom .. am i right r missing sumthng big ??

Answer 1

they check the IP. they check with the ISP if it's a Dynamic IP. if it's a static IP then they can probally tell. if the virus didn't come from the PC then it came from the ISP or the line that is between the computter (different files are on the line from different PC) and the source.

Answer 2

An IP address is not much good at identifying a person or even a computer unless you have two things to go along with it:

1. The exact time that you saw this IP address.

2. The ability to subpoena the name and address of the customer who had that IP address at that exact time from the ISP that owns the IP address.

The kinds of people who track down where a virus or worm originated from (the FBI usually but other groups are involved too) often have both of these things.  They also often have the ability to get a warrant to enter the house, seize all computers and analyse them at their leisure.  They will usually find evidence on one of the seized computers of the virus and how it was released.