Cyber Crime and Cyber Terrorism

OFFLINE (DEAD) DATA CAPTURE
This is the traditional method of data capture, through the removal of the main stor-
age unit, typically a hard drive: an exact replica is made of the data on the device and 
later analyzed.
An essential principle of forensics is that the original data, which might be used 
as evidence, is not modified. Therefore, when processing physical evidence, it is 
imperative that a write-blocker is used; a write-blocker captures and stops any re-
quests to write to the evidence. This device sits in line with the device and the analy-
sis machine. There are numerous write-blockers available that can protect various 
kinds of physical devices from being modified by the investigator. There are physi-
cal write-blockers, which are physically connected to the digital evidence and the 

---

64
CHAPTER 6
High-tech investigations of cyber crime 
analysis machine. There are also software-based write-blockers which interrupt the 
driver behavior in the operating system.
VERIFICATION OF THE DATA
Having captured the data the first step, as a high-tech investigator, is to confirm that
the data has not been altered. To facilitate this, the data capture has its hash value 
recalculated; this is then compared against the original hash. If these do not match 
then no further steps are performed until the senior investigating officer, or manager, 
is contacted and the situation discussed. Such an error may undermine even the most 
concrete evidence found on the exhibit. Hash mismatches can occur if the data was 
not copied correctly or there may have been a fault with the original device. The 
original exhibit may need to be revisited and a new image created. This may not be 
possible if an online, or live data capture, was performed as the data may no longer 
be available. The second the capture is made, new data may be added to the device 
and any old data may be overwritten, meaning the device will never be in the same 
state again.