Some attackers are able to breach computer security from outside using the network connections. While they are often masquerading as others, the record of when and how the data arrived can offer crucial clues for any investigator assembling a time line.