Investigation pathway

I have been given an IP address

Use this route to establish what the record actually contains, preserve the right supporting information and avoid treating an address as a person.

3 core questions Text-first complete without video Course-ready not yet a course

1

Orientate

Establish what you have

Identify the address, timestamp, timezone, source system and investigative question before drawing conclusions.

[Open IP-001](../library/ip-addresses-and-networks/ip-001.md){ .ifd-step-link }

2

Challenge attribution

Could the connection have been shared?

Consider household, workplace, public access, NAT, CGNAT, VPN, proxy and compromised-device explanations.

[Open IP-017](../library/ip-addresses-and-networks/ip-017.md){ .ifd-step-link }

3

Preserve and request

Secure the supporting records

Move from the address alone to provider, account, device and contextual records while they may still exist.

[Open IP-032](../library/ip-addresses-and-networks/ip-032.md){ .ifd-step-link }

Pathway outcome

You should now be able to frame the next decision

The pathway does not promise attribution. It helps identify what the address contributes, what remains unknown and what evidence should be pursued next.

[Ask IF Digital](../ask.md){ .ifd-button .ifd-button-secondary }