Cyber Crime and Cyber Terrorism

part of any investigation in one way or another:
• 
Used to conduct the activity under investigation
: the device is the main focus 
of the activity, such as the main storage and distribution device in a case of 
indecent images of children.

---

60
CHAPTER 6
High-tech investigations of cyber crime 
• 
Target of the activity under investigation
: the device is the “victim,” such as 
in an incident of hacking.
• 
Supports the activity under investigation
: the device is used to facilitate the 
activity, such as mobile phones used for communication.
High-tech investigations relate to the analysis and interpretation of data from digital 
devices, often called upon when an incident (criminal or civil) has occurred. They are 
not purely about using the most advanced technology to perform the work. A good 
proportion of what is done is actually “low-tech” in the sense it is the investigator’s 
mind doing the work and interpreting the data that is available. The primary objective 
of a high-tech investigations is to identify what happened and by whom.
CORE CONCEPTS OF HIGH-TECH INVESTIGATIONS
It is generally agreed that a high-tech investigation encompasses four main distinct 
components, all of which are important toward the successful completion of an 
investigation:
1. 
Collection
: the implementation of a forensic process to preserve the data 
contained on the digital evidence while following accepted guidelines and 
procedures. If performed incorrectly any data produced at a later date may not 
stand up in a court of law.
2. 
Examination
: systematic review of the data utilizing forensic methodologies 
and tools whilst maintaining its integrity