This is done in a variety of ways, depending on the facts of the case and is usually circumstantial, for example, the defendant was required to use a unique password to access a Government computer system which was defrauded, the fact that a computer was seized from a house where only the defendant lived etc.

Identification of an offender remains a consistent challenge across all jurisdictions. The Commonwealth Director of Public Prosecutions (who is responsible for the prosecution of cybercrime offences at the federal level) is unaware of any specific approaches by prosecutors (more specifically, investigators) to overcome this challenge. Australian Prosecutors do not have an investigative function. Investigators continue to rely on other evidence such as witness/victim statements, physical and electronic surveillance, and admissions by offenders.

The chain of custody of the electronic device is often used in such cases.

All electronic equipment (computers, hard disks, media devices, etc.) is submitted to experts for analysis. While analysing such equipment, we search for evidence able to provide information on the user of the computer at the time of the offence. We usually analyze the equipment in the location where it is and search, among others, the e-mail and social network accounts used. While carrying out an authorized search, the police officer in charge conducts a short interview, which usually includes questions on the place's residents, their habits and the persons who have access to the equipment seized.

Establishing the parties to a communication is far more problematic with increased reliance by all members of society on electronic forms of communication such as email, text messaging, PIN to PIN, Internet-based communications, etc. See R v Fraser, 2011 BCSC 32. Circumstantial evidence will often be the only means by which to establish identification of who is speaking or communicating. The following methods have proved helpful: proving possession of the communication device (seizure upon arrest or execution of a warrant), subscriber information, surveillance (pursuant to a court authorization, where required), analysis of the content of the communication and forensic examination of the communication device. In circumstances when a suspect is known to be technologically sophisticated and will take measures to destroy, delete or encrypt electronic evidence (often triggered by automated computer programs or modified electronic devices), traditional investigative techniques such as knocking on a suspect’s door on a ruse (e.g. making a delivery) at a time when the police know the computer is in use (for example, during the commission of an offence) may help preserve evidence, particularly when it is collected by trained computer forensic investigators.

When available electronic evidence includes e-mails or other forms of instant messaging communication, it is usually possible to identify the person who carried out criminal activities.

The prosecutor consults the investigators to make sure that the forensic reports and expert witnesses can establish that link if there is one to be found. Subscriber information is usually helpful.

L'enquête a pour but de démontrer ce lien clair: en partant de l'adresse IP, il convient d'établir quel est l'auteur réel de l'acte, des investigations techniques et des auditions classiques doivent donc être menées parallèlement.

Experts' opinions are used to establish such links, which are then presented as evidence in court.

- Data media seized during searches

- Internet searches for nicknames or profiles

- Enquiry of stock and use data from telecommunications providers (attribution of a connection or an e-mail address to an individual)

- Evaluation of content data that have been recorded

- Enquiry or recording of telecommunication traffic data

- Monitoring of telecommunication (telephone, mobile, Internet communication)

The link is usually established during the criminal investigation of which the prosecutor is in charge. All the investigation steps leading to the identification of a specific perpetrator must be laid down in the police report.