Cyber Crime and Cyber Terrorism

75
 
Seizing equipment
safe. Hence one of the principle objectives in identifying a malicious party is often 
to associate them with their online persona, e.g., IRC handle, nickname, or twit-
ter username. In digital forensic and hacking communities there is a term “doxing” 
which discusses how this can be achieved. Doxing is a term derived from the words 
document and tracing and essentially is the process of collecting information about 
Internet users which they would rather not be known, and of which they are prob-
ably not aware they have made available publically. Performing a successful “dox” 
involves gathering information such as, full name, date of birth, usernames, email 
accounts, home addresses, phone numbers, personal images and of course the online 
nicknames and handles of an individual. The techniques and practices necessary to 
perfect doxing involve a deep understanding of search engine operators, and how to 
collect together information from online sources such as social media, online ad-
vertising or anywhere else where information may have been published or leaked. 
They involve intelligent methods of cross referencing information between sources 
to build a profile of the suspect. Again, for the cyber investigator the aim here is 
to associate the incriminating evidence published via an alias with the suspect true 
identify with a view to gain a search and/or arrest warrant.
COLLECTING EVIDENCE
Once a search warrant has been granted, evidence of the suspected crime needs to 
be obtained; there are strict guidelines for how equipment should be seized, digital 
images acquired and evidence stored. These guidelines can vary dependent upon the 
jurisdiction of where the suspected crime took place, however, they all share pro-
cesses related to the physical requirements, e.g., preservation of evidence. These will 
be discussed in the following sections.