Attribution of Messages to Sources in Digital Forensics Cases

This paper presents advances in and limits on the attribution of messages to sources in digital forensics cases. It overviews current attribution technologies, the limits of those technologies, identifies ways in which attributions are made today and their limits, and discusses available methods for attribution within the legal system and the limits of digital forensic evidence for use in these purposes. It then presents a set of tools for message attribution now in use and identifies how they are being used and the limits of their applicability to forensics. The present and historical situation show a need for improved attribution, and clearly there is a long way to go before a sound scientific basis for attributions of messages to sources will be definitive.