MacRoadie said:
Ok, I'll bite.
If the emails weren't in fact sent by Baker, then I'm stuck on a couple of things.
One, how could the forger find Baker's alleged IP address (assuming it was a static IP) in order to "plant" it in his forgery?
Two, how did the French investigators, in turn, also trace this IP address back to Baker?
1. Arnie Baker does have an IP address associated with him, sort of. He owns arniebakercycling.com:
> host arniebakercycling.com
arniebakercycling.com has address 38.113.1.181
arniebakercycling.com mail is handled by 30 mail.arniebakercycling.com.
As for 2. That's where things get more interesting. Suppose they had this IP address. They could look up what name is tied to this address. And this is what they'd find:
> host 38.113.1.181
181.1.113.38.in-addr.arpa domain name pointer ip38-113-1-181.yourhostingaccount.com.
The address is associated with a web hosting company. Even the name of the company is obscured. It turns out that Tucows owns this domain, and they do webhosting for literally millions of websites. There is no direct lookup you can do on this IP address that will give you arniebakercycling.com. You can contact Tucows and tell them you have a possible mail forgery and they'll yawn and say what else is new, we only had a few million other mail forgeries today, and they'd tell you they can't divulge any customer records without a court order, and you're in France, so that'll take weeks to months, by which time Tucows probably deleted all those logs, because their lawyers insisted that they have a logfile expunging policy, precisely so they couldn't be sued for not keeping those files around forever.
But what if the mail headers DID say that the mail was received from arniebakercycling.com specifically, and not just an IP address? That's clearly a red herring. Because when a mail server receives mail, it only sees the IP address, which it then looks up using the same methods I used above, meaning it would find yourhostingaccount.com and put that in the Received-by line, and not arniebakercycling.com. So it would be impossible for a Received-by line of a mail header to contain arniebakercycling.com, unless it was a forgery.
So now do you start to see why it makes no sense that they reported they had Arnie Baker's IP address?
And that's the simplest possible case. It's actually really unlikely they would be receiving email directly from that IP address for a variety of reasons. Likely scenarios are much more complicated and would require getting court orders for three of four different big service providers, one at a time before you ever find your way to anything that can be connected to a person.