Cybercrime and Digital Evidence
Cybercrime Typologies and Digital Evidence
Know the common cyber-enabled financial crimes: phishing/smishing/vishing, business email compromise (BEC), account takeover, malware and ransomware, credential stuffing, and payment card skimming. Understand the cyber kill chain concept and the value of indicators of compromise (IOCs) such as IP addresses, domains, and file hashes. For digital evidence, the core principles are forensic soundness: preserve the original, work on copies, hash for integrity, maintain chain of custody, and document every action. Understand volatility - memory and session data disappear on shutdown - so preservation order matters.
Traps and Rule of Thumb
Traps: assuming deleting a file removes it (recovery from backups or unallocated space is often possible); confusing authentication with authorization; treating a BEC as a purely technical issue when it is often a social-engineering and control failure; and forgetting jurisdiction and cross-border evidence issues. Also know data protection constraints on handling personal data during investigations, and that log retention is often the decisive factor in proving a timeline.
Rule of thumb: Preserve first, analyze second. Before touching a device, capture volatile data and logs; hash and document; never alter the original.
Worked example: A firm receives a fraudulent payment-redirect email appearing to come from a known supplier. Steps: preserve email headers, logs, and mailbox data; identify the sender domain and login IOCs; check whether mailbox rules were created; confirm whether credentials were compromised; document chain of custody; and coordinate with the bank and law enforcement quickly, since recovery windows are short.