Answer to Question 1
Because many Internet users have dynamic IP addresses that can change from day to day, or even hour to hour, the date and time of the violation become extremely important. Timestamps within the communications will greatly aid the investigator in narrowing their search. Remember the bowling shoe analogy from Chapter 1 . If there are 10,000 bowlers in the world and only 5,000 pairs of bowling shoes, the world's bowlers will have to rent out shoes while bowling and return them when finished so other bowlers can use them. For the sake of example, say that one of the bowlers commits a murder while wearing a pair of rented bowling shoes. The murder happened at 1 pm on Sunday, March 5, 2006 . The murderer leaves tracks in the mud, which have a distinctive pattern. Through pattern analysis, the police trace that pair of shoes back to the bowling alley that rented them out. Now all the police will need to do is check the bowling alley records to see who rented the shoes at 1 pm on Sunday, March 5, 2006 .
In this analogy, the bowler is an internet computer while the bowling alley is the internet service provider.
Answer to Question 2
E
