Image retrieved from CPC Press
As mentioned in the last post there is not much difference between a physical crime scene and a digital one. The main difference is the type of evidence that is collected. There are several types of investigations that are specific to computer crimes. These investigations are single-scene, multiple-scene, and network investigations. Each of the three rely on specific skills from the people who are involved. Single-scene investigations are tailored towards skills that are found from law enforcement investigators, whereas multiple-scene investigations require coordination and networking skills. According to Taylor et al. (2015), “networking skills may be provided by a subject matter expert (e.g., a computer consultant)” (p. 273). The last of the three, network investigations require the skills of both multiple-scene personnel and outside experts. Like with any crime scene, everyone who responds has a specific role to abide by. Those who are often involved with crime scenes include, first responders, investigators, forensic analysts, private police, and subject matter experts. These actors coordinate with each other to collect and analyze evidence in order to prepare it for trial if necessary.
Single-scene investigations are a little less complicated than multiple-scene and network investigations, but it is important to understand what counts as digital evidence and what must be done to collect evidence legally. Like all investigations, law enforcement officials must have proof of probable cause and complete an affidavit to be granted a search warrant. The affidavit must “specify that a crime has been committed, evidence of the crime exists, and the evidence presently exists in the place to be searched” (Taylor et al., p. 277, 2015). Digital evidence often consists of computer systems, external storage media, handheld devices, and networking equipment. Once law enforcement has access to the scene, they begin to look for the evidence that fits the crime committed. Documenting any visible evidence is the first step they do prior to collecting anything. Once the scene has been properly documented, law enforcement can begin collecting and preserving the evidence that is present at the scene. Some evidence have specific rules to follow when collecting it. For example, evidence such as computers, it is extremely important to either leave it on if the computer is on or collect it and submit it for further analysis. Like at a physical crime scene, analysts fill out a form called the computer evidence worksheet. This sheet contains crucial information that pertains to case number and all computer information that is available.
Unlike single-scene investigations, multiple-scene and network investigations are a lot more complicated by a number of factors. These networked environments may “contain evidence on multiple machines using multiple operating systems, in multiple physical and/or network locations, and in multiple jurisdictions” (Taylor et al., p. 285, 2015). Having to maneuver multiple networks can become quite complicated for the analysts. Collecting evidence can be challenging due to the fact that there can be minimal intrusion into the network by law enforcement officials. Collecting digital evidence is becoming more challenging because while technology continues to advance, law enforcement is struggling to keep up with it. In order for law enforcement to fight computer crimes, there needs to be more training by experts who specialize in digital crime scenes.
Taylor, R., Fritsch, E., & Liederbach, J. (2015). Investigation of computer-related crime. In Digital crime and digital terrorism (Third e., pp. 297-320). Upper Saddle River, New Jersey: Pearson.