Internet forensics relates to the analysis of any activity taking place on an electronic device using the Internet. Internet activity taking place on a computer or mobile device is recorded by default. Using forensic methodologies this activity can be extracted from the device for analysis. Internet activity can potentially show a large amount of information such as the websites visited on the device, search terms inputted by the user, communications taking place via the Internet and file download activity.

In cases involving fraud the Internet is often used to exchange stolen credit card information and to carry out fraudulent transactions. Internet forensics can help to identify sessions of Internet based communications and identify these transactions.

Piracy/Intellectual Property theft is a growing issue which is prevalent on the Internet. Data is often illegally copied and then shared with other users via peer to peer networks. This activity can be identified on a device using Internet forensics.

Examples of sources of downloadable material which may be referenced in cases such as these are as follows:

- Limewire

- uTorrent

- Usenet

- Rapidshare

- Bearshare

- Shareaza

- Kazaa

- Azureus

- Frostwire



When investigating cases involving indecent materials it is often the case that this material originates from the Internet. This source can be from websites, peer to peer networks or directly from other users. Internet forensics can help identify the source of the materials and identify how they came to be on a device. It is also possible to profile Internet activity to identify who was using the device at the time materials were downloaded.


In a Corporate environment instances of employee misconduct can arise. This may take the form of an employee viewing websites via the Internet during work hours or using the Internet to pass sensitive information to another individual. In these cases Internet forensics can be used to track this activity and provide evidence of these actions.