Cyber Crime and Cyber Terrorism

72
CHAPTER 7
Seizing, imaging, and analyzing digital evidence
the evidence must support the assumption that a crime has been, is being, or will be 
committed or orchestrated from the premises.
COLLECTING EVIDENCE FOR A SEARCH WARRANT
Evidence that cybercrime has been committed can be collected in various ways de-
pendent upon the crime being committed, with the crimes usually falling into one of 
the following four broad categories:
• Piracy: The reproduction and dissemination of copyrighted material.
• Malicious Hacking: The act of gaining illegal, unauthorized access to a 
computer system. This includes Phishing and identity theft.
• Child Pornography: The distribution, owning or viewing of child pornography.
• Financial: The purposeful disruption of a company’s ability to conduct 
electronic commerce.
Regardless of the type of cybercrime committed, it is necessary to associate the sus-
pect with the crime. The following sections discuss the techniques, tools, and meth-
ods for performing this.
REPORTED BY A THIRD PARTY
Parties who are suspected by a member of the public of having committed cyber-
crime can be reported to law enforcement. The criminal act could be discovered as a 
result of a work place audit or security monitoring program. Alternatively, it could be 
made by an individual who has become aware of criminal activity in a social context, 
either online via social media or in person.
IDENTIFICATION OF A SUSPECTS INTERNET PROTOCOL 
ADDRESS
A public Internet Protocol (IP) address uniquely identifies every device directly con-
nected to the Internet. IP addressing employs a 32 bit (IPv4) or 128 bit (IPv6) hierar-
chical addressing scheme. The IP address is used by intermediary routers to make a 
decision on which path data packets should take from source to destination. When an 
IP address is used to potentially identify a suspect it has usually been assigned to the 
suspect by their Internet Service Provider (ISP) to their perimeter router. For a home 
user this would typically be housed on their premises. Their IP address remains en-
capsulated within the packets of data that constitute a communication session, and it 
uniquely identifies the public facing interface of that router. Identifying an IP address 
in a malicious communication is sufficient evidence to govern the issuing of a search 
warrant and arrest. However, there are some issues with this method of identification, 

---