Cyber Crime and Cyber Terrorism

CHAPTER
71
7
Seizing, imaging, and 
analyzing digital evidence: 
step-by-step guidelines
David Day
INTRODUCTION
There are a number of approaches that can be taken when creating and subse-
quently executing a plan for a forensic investigation. Those that are selected, or 
created, are done so largely subjectively. However, there are certain criteria which 
should be followed both in terms of meeting best practice, complying with laws 
and regulations, and also ensuring any evidence discovered remains admissible in 
court. It is the purpose of this chapter to offer guidance in how to meet these aims, 
and in addition to discuss some of the more insightful methods used when search-
ing for incriminating evidence. Further, it is intended to provide the examiner with 
an overall view of the processes. From what needs to be considered when applying 
for a search warrant, through to how to seize and acquire evidence appropriately. 
Finally it is discussed how to apply inventive methods to uncover crucial evidence 
via forensic analysis, including evidence that may have been obfuscated via anti-
forensic techniques.
ESTABLISHING CRIME
Forensic evidence is usually gathered by a search of a suspect’s premises and sei-
zure of the relevant equipment. To do this legally it is typically necessary to obtain 
a search warrant. The details of this process differ depending on the laws of the 
country and the jurisdiction in which the alleged offence took place; however, in 
most instances warrants are supplied by a judge who has been convinced that enough 
evidence exists to justify its issue. For example, in the UK a judge needs to be satis-
fied that there are “reasonable grounds” for believing that an offence has occurred 
(
Crown, 1984
). Normally this offence would be listed under the computer misuse act. 
In the United States, the process is similar with the fourth amendment’s inclusion 
of the term “probable cause” being cited (
FindLaw, 2014
). It is beyond the scope of 
this work to fully explore what is meant by both “reasonable grounds” and “prob-
able cause” but in either case it is clear that significant evidence is need, and that the 
request to search a premises is not based on simply a suspicion or a hunch. Further, 

---