Cyber Crime and Cyber Terrorism

LIVE AND ONLINE DATA CAPTURE
Live data capture is utilized when the device is not taken offline: that is, it is decided 
not to turn it off. For example if a critical business server is taken offline it may 
cause disruption or loss of revenue for the business. If a program is running, it may 

---

63
 
The “crime scene”
mean critical data will be lost or it will not be possible to recover that information 
if the power is removed. This can also be the case when dealing with encryption: if 
the power is turned off, the data is no longer in a format that is accessible without 
the correct password.
A high-tech investigation should enable someone to follow the steps performed 
and produce exactly the same results. However, the problem with live data is that it 
is in a constant state of change, therefore it can never be fully replicated. Although, 
these issues exist, it is now accepted practice to perform some well-defined and 
documented live analysis as part of an investigation, and the captured data can be 
protected from further volatility by generating hashes of the evidence at the time that 
it is collected.
Traditionally, when looking for evidence in relation to website access, data would 
be captured from the local machine in the form of temporary internet files. However, 
as advanced Internet coding technologies leave fewer scattered remnants on a local 
machine, techniques must now be used to log onto an actual webpage and grab the 
contents that can be seen by a user. Alternatively, requests can be made of the service 
provider to produce the information. This process requires detailed recording of the 
actions performed and a hash of the file at the conclusion. An example of online 
data capture is the capture of evidence from Social Networks, which is now becom-
ing progressively prominent in high-tech investigations, including those related to 
cyberbullying.
With live data, even with the securing of a physical crime scene, it is still possible 
that an outside influence can be applied to the digital data, such as remote access. It is 
very important therefore that this information is seized digitally as soon as possible. 
If possible the data on the device should be reviewed and once satisfied that data 
will not be lost, the device should be isolated from network communication, mobile 
signals or any other form of communication that could allow data to be removed or 
accessed remotely. In large organizations support should be sought from the system 
administrators to help in the identification and isolation of digital devices, to prevent 
unwanted corruption of important data. The devices can then be removed or the data 
captured using appropriate tools.