Cybercrime, Investigations, and Digital Evidence
Domain 4: Cybercrime, Investigations, and Digital Evidence
This domain tests how computer-crime law, investigative authority, and evidence handling fit together. Questions often ask whether conduct is criminal, what legal process obtains the data, and whether the evidence will survive authentication and chain-of-custody challenges.
Computer-crime and investigative authority
- CFAA (18 U.S.C. § 1030) covers knowingly accessing a computer without authorization or exceeding authorized access to obtain protected information, commit fraud, cause damage, or traffic in access. Van Buren limits "exceeding authorized access" to gates-up/gates-down entitlement, not every terms-of-use breach.
- ECPA governs interception and stored records: Wiretap Act for content in transit; Stored Communications Act for stored content and records; Pen Register Act for dialing/address information. Government access generally requires a warrant for content, while non-content may be compelled by subpoena or court order depending on the service and age of records.
- Fourth Amendment limits government searches; private-sector investigators are not state actors, but they may become agents if directed by law enforcement. Exceptions include consent, exigent circumstances, plain view, and border searches. Employee monitoring is often governed by policy, contract, and state wiretap law.
Evidence handling
- Prefer forensic images or logical exports with hash values; use write blockers; document who handled what, when, and why. Volatile data (memory, connections, processes) may need capture first.
- Preserve metadata and original formats. Screenshots alone are weak for authenticity. Chain-of-custody gaps can lead to exclusion or reduced weight.
- International evidence often requires MLATs or letters rogatory; the Budapest Convention facilitates cooperation, and the CLOUD Act addresses certain cross-border requests. Data localization laws can block production.
Worked example
An employee copies customer files to personal cloud storage, then resigns. The company images the laptop with a write blocker, hashes the image, preserves cloud audit logs, and obtains counsel-approved consent language for the exit interview. Law enforcement later seeks the employee's cloud email content; because it is stored content, the provider generally requires a warrant or valid legal process. The CFAA theory depends on unauthorized access or damage, not merely a confidentiality breach.
Traps
- Imaging the original without a write blocker or hash.
- Relying on screenshots without metadata.
- Assuming private searches require a warrant.
- Confusing SCA warrant and subpoena categories.
- Ignoring international process and spoliation risk.