Cyber Crime and Cyber Terrorism

62
CHAPTER 6
High-tech investigations of cyber crime 
If attendance at a “crime scene” is required then the overarching rule is to pre-
serve the evidence. This, however, cannot come before the safety of those on site. 
Once personal safety is assured then evidential preservation can commence. At the 
first opportunity everyone not involved in the investigation should be removed from 
the vicinity of all keyboards or mice (or other input device) so that no interaction can 
be made with any digital device. If left, people can cause untold damage to the digital 
data making the later stage of the investigation much harder, if not impossible.
The physical “crime scene” should be recorded using photographs, video record-
ings, and sketches. This makes it possible to identify the location of devices at a later 
date, and also allows a third party to see the layout and the devices 
in situ
. It may 
be that these images are reviewed at a later date and, following analysis, important 
points found in the digital data allow inferences to be drawn from what was physi-
cally present; such as the connection of a USB DVD writer.
With the sheer number of digital devices that may be present at a “crime scene” 
consideration must be made to the likelihood that a device contains information in re-
lation to the investigation. It is no longer feasible to go on site and seize every single 
digital item, budgets and time constraints will not allow this. Consideration must be 
made as to the investigation type, the owner of the device and any intelligence and 
background information available to determine whether the device is suitable for 
seizure. Such a decision should be made in conjunction with the lead investigator and 
legal and procedural restrictions.
If a device requires seizing, it should first be determined if the device is on or 
off. If on, then consideration should be made of live data capture and a record made 
of all visible running programs and processes. Once a decision has been made and 
any live data captured, the power should then be removed from the device. If the 
device is a server, or similar device, running critical systems and databases, then the 
correct shutdown procedure should be followed. It is possible that an unscrupulous 
individual has “rigged” a system to run certain programs, or scripts, when it is shut-
down, such as wiping data or modifying certain information; however, the risk of 
losing critical business information through a corrupted database or system needs to 
be considered fully. Generally a normal home laptop or computer can simply have 
the power removed. Once taken offline, or if it is already off, the device should be 
placed into an evidence bag with a tamper evidence seal and the chain of custody 
maintained. Each device should be given a unique reference number to aid identifica-
tion - and these should be unique to each high-tech investigation.
Once the crime scene is physically secure attention needs to be made of the de-
vices to be seized and how technically to achieve that - this is detailed in the follow-
ing sections.