> if you have a seized messageboard and an upload record from an IP address, and that's all you have, how do you investigate? If I ran a message board, not onl

> if you have a seized messageboard and an upload record from an IP address, and that's all you have, how do you investigate? If I ran a message board, not only would I not capturing the upload IPs in any log files (hello GDPR in any case), I'd be tempted to put fake upload IPs in instead -- change the first two or three octets so the logs point to a government owned range.