Cyber Crime and Cyber Terrorism

REVIEWING THE REQUIREMENTS
The requirements of the investigation, or remit, provide the specific questions that 
need to be answered. This can be used to identify possible routes for analysis. It is 
important to ensure a thorough analysis of the requirements is made early on in the 
investigation to ensure that time and money are not wasted. From the remit, along-
side any background information provided, the following need to be identified as a 
minimum:
1. 
Number and type of exhibits
: so it is known what data is to be investigated
2. 
Individuals/business involved
: so it is known who is to be investigated
3. 
Date and times
: so it is known when the incident occurred, which will provide 
a time window to be investigated
4. 
Keywords
: what may be of interest during the investigation if it is found, this 
could be names or bank account numbers for example
5. Supplied data
: if a particular file or document on the data is to be looked for—
it is useful if a copy of this is provided
STARTING THE ANALYSIS
There may be a wealth of information gleaned from the captured evidence some of 
which may not be relevant. No one process or method will necessarily answer all the 
questions posed. It is important to remember the following points when reviewing 
information to ensure nothing is missed or misinterpreted:

---

65
 
Starting the analysis
1. 
False Positives
: files that are not relevant to an investigation but they may 
contain a keyword that is important
2. 
Positives
: files/data that are relevant to the investigation
3. False Negatives
: files that are not picked up but are relevant—they may be in
an unreadable format (for example, compressed or encrypted)
The actual analysis of the data will vary depending on the type of investigation that 
needs to be carried out. Therefore at the beginning of the investigation consideration 
and a careful analysis must be made of the actual questions that are being asked.
The analysis of data can be broken up into two stages: