[AC-Admins] Need help tracking down IP addresses for criminal case

[Scott Garron]

On 10/6/2010 12:13 PM, Jacob OHare wrote:
> Hello, I have a friend who is facing a criminal trial and he needs IP
> addresses for his location to prove he wasn't in the area. What can I
> do to get this information because of the encoding.

      I've already addressed this with about 4 people so far who have
asked for basically the same information about the same person.  I've
provided general GeoIP information for the timeframes asked:  All of
January, February, part of April, and part of May.  What more do you
need?  It's getting a bit tiresome, to be honest.

      As far as decoding the hashed IP address, I'm afraid that while
it's not completely impossible, it's not easily achieved.  After having
enough known quantities and plotting them into a rainbow table, it may
be possible to get closer to reversing a hash, it's not practical.

      Our logs, on the other hand, store the IP addresses/hostmasks in
clear form before the hash is applied.  If there's yet another specific
timeframe you'd like more detailed information about, give me the exact
nickname, the day, and the general time of day.  I'd rather not provide
the complete IP address because of trust/privacy issues, but I'll be
willing to provide ISP information and the general geographic location
that the IPs are supposed to come from.

      Now, all that being said, my opinion on the matter is that having
an IP address doesn't really "prove" much of anything.  Remote desktops,
proxies, remote shells, bouncers, and what have you make IP addresses
mean very little in regards to a person's actual, physical location.

-- 
Simba