Cyber Crime and Cyber Terrorism

1. 
Pre-Analysis
: if this is done incorrectly it can have a major impact on the 
rest of the investigation. It is the process of getting the data ready to make the 
actual analysis as smooth as possible. This process is all about preparing the 
data through the recovery of deleted files and partitions, and the mounting of 
compressed file and folders and encrypted files (so they then become searchable 
and have context)
2. Analysis
: this is the review of the data to find information that will assist in the 
investigation, through the identification of evidence that proves, or disproves, a point
A high-tech investigation should not be dependent upon the tool used; a tool is simply 
a means to an end. However, it is important that the investigator is comfortable and suf-
ficiently qualified and experienced in using the chosen digital analysis tool. The ability 
to click a button in a forensic tool or to follow a predefined process is not forensics—
this is evidential data recovery. A high-tech investigator must be able to review what 
is in front of them and interpret that information to form a conclusion, and if appropri-
ate, an opinion. The location of evidence can be as important as the evidence itself; 
therefore careful consideration must be made as to the context of what is seen. If a file 
resides in a user’s personal documents folder, it does not mean that they put it there. It 
is the investigator’s role to identify its provenance and provide context as to how it got 
there, when, and whether it has been opened. The interpretation and production of such 
information may help in proving, or disproving, an avenue of investigation.
There is no correct way to begin the actual analysis of the data; there is no rule 
book which will state exactly what to do and what to look at. Depending on any legal 
restrictions, the investigator may be limited to only reviewing certain files and data. 
If there is any uncertainty on this issue the investigator must discuss this with their 
manager or the senior investigator. If all data can be accessed then the investigator 
can browse through the folders and files. If anything stands out as “unusual” or of 
interest it may provide direction and focus to the technical analysis steps. To some 
extent this may depend on the operating system under review.
At the start of an investigation a check should be made to ensure that all the 
expected data in the capture is accounted for. It is very easy for partitions on a disc 
to be modified so that they are not seen straight away or for a partition to be deleted 
and a new one created. In terms of a physical disc this may involve the review of the 
number of sectors available on the disc compared to those currently used.

---