Not only will the messages provide crucial information that was exchanged between the participants, but an IP trace could be performed on the other participants of the chat sessions. If the suspect deleted the messages prior to the confiscation, gaining any e-evidence may be somewhat more difficult. Instant messaging programs can often be setup to not store exchanged messages. If the suspect used these settings while messaging the participants, it may be possible to obtain the messages from the RAM instead. At the very least, the timeline of the exchange may be recovered from the program, in the absence of messages. It may also be possible to recover the names of the participants and their IP
Not only will the messages provide crucial information that was exchanged between the participants, but an IP trace could be performed on the other participants of the chat sessions. If the suspect deleted the messages prior to the confiscation, gaining any e-evidence may be somewhat more difficult. Instant messaging programs can often be setup to not store exchanged messages. If the suspect used these settings while messaging the participants, it may be possible to obtain the messages from the RAM instead. At the very least, the timeline of the exchange may be recovered from the program, in the absence of messages. It may also be possible to recover the names of the participants and their IP