Cyber and Technology-Enabled Crime Investigation
Cyber and Technology-Enabled Crime Investigation
This domain tests digital evidence preservation, lawful access, forensic integrity, and investigation of network intrusions, identity theft, online fraud, and technology-facilitated offenses.
Core rules
- Preserve data in order of volatility: memory and network connections before disks; logs before overwrite. Use write-blockers for static media and hash forensic images with SHA-256 or MD5 to show integrity.
- Legal authority must match the search. A consent to search a laptop does not necessarily authorize a cloud account or a phone. Warrants and subpoenas must describe the place to be searched and items to be seized; use plain-language attachments where appropriate.
- Common statutes include 18 U.S.C. § 1030 (computer fraud and abuse) and identity-theft provisions. Attribution requires corroboration, not just an IP address.
- Maintain chain of custody for devices, images, and exports. Document tool versions, examiner actions, and time-zone settings.
- Collect only what is authorized; use filtering or taint teams where privileged or unrelated material is likely.
- Corroborate digital artifacts with subscriber records, network logs, interviews, and financial records.
Worked example
An AF network account is used to exfiltrate personnel data. The agent preserves firewall and authentication logs, images the suspect workstation with a write-blocker, hashes the image, and obtains a warrant for the account's contents. Reasoning: logs are volatile and must be captured first; the image preserves the workstation without altering it; the account requires separate legal process; hashes support authenticity.
Traps
Booting a suspect computer before imaging; relying on screenshots instead of native exports; exceeding consent scope; failing to document time-zone and tool settings; and overlooking exculpatory data that undercuts the attribution theory.