Cyber Crime and Cyber Terrorism

CHAPTER
59
6
High-tech investigations
of cyber crime
Emlyn Butterfield
INTRODUCTION
Digital information has become ubiquitous with the world of today; there is an increas-
ing reliance on digital information to maintain a “normal” life, communication and 
general socialization. The prolific use of networked devices now allows anybody from 
any country to now attack, or utilize a digital device to attack, their next door neighbor 
or someone on the other-side of the world with only a few clicks of a button. People’s 
ignorance, including criminals, of what information a device stores and the amount of 
data it generates means that a properly trained and equipped expert can recover and 
make use of information from almost any digital device. This same digital information 
can now provide evidence and intelligence that can be critical to criminal and civil 
investigations. Understanding the threat of cyber-crime and cyber-terrorism allows us 
to put into context the current technical situation, however identifying the potential for 
attack is only the start. Within this chapter we will be looking at defining high-tech 
investigations and evidential processes that are applicable to all investigations. The 
description and processes will aid in the investigation of a crime, or malicious action, 
after the event has occurred.
HIGH-TECH INVESTIGATIONS AND FORENSICS
The term “forensics” can bring to mind popular American television series. Television 
shows that glorify forensic analysis such as these have both helped and, to some 
extent, hindered forensic science. It has helped by bringing the concept of foren-
sic capabilities to a wider audience so that a heightened level of awareness exists. 
Conversely, it has also hindered it by exaggerating the technical capabilities of foren-
sic scientists: no matter what the television shows suggest it is entirely possible for 
data to be beyond recovery by even the most eminent experts. However, surprisingly, 
many users remain ignorant of the kind of data that can be scavenged from various 
digital sources that will underpin an investigation. Digital devices are essentially a