f1cb68ba_rime_Toolkit_for_Investigators__Step
[What Happens] Based upon the known facts, begin to state the “who, what, where, when, why, and how” of the case. Like in any investigation, this will be a continuous process as evidence and leads are tracked down and results are analyzed. Who: Victim information and suspect information, if known What: Purchase, theft, etc., using victim’s identifiers. Which identifiers were used? Where: Merchant locations or IP addresses logged, delivery addresses, land line phone numbers, etc. When: As per billing/account statements, etc. Why: Motive How: Were the identifiers compromised? Were the identifiers used? e.g., Internet, phone purchases, benefits [Step] 
Begin Analysis
Investigative Steps | Identity Crime Toolkit for Investigators
Step