UNIT III

Violent Crime and Digital Evidence• Violent crimes are challenging to investigate not only because

of the severe behavior that is involved, but also the complexity of formative events and relationships.

• Information is key to determining and then understanding the victim-offender relationships and to developing ongoing investigative strategy.

• Consequently, any detail gathered from the digital evidence can be important, and digital investigators must develop the ability to prioritize what can be overwhelming amounts of evidence.

• loss or mishandling of exonerating digital evidence could result in an innocent person being convicted. To avoid such problems in a violent crime investigation, training is needed to ensure that digital evidence is handled properly and interpreted correctly.

1. The Role of Computers in Violent Crime

• Digital investigators can use information gleaned from many forms of digital evidence to find likely suspects, uncover previously unknown crimes, develop leads, build a more complete timeline and reconstruction of events, and check the accuracy of witness statements and offender statements.

1. The Role of Computers in Violent Crime

Cyber trails

• Computers may contain useful information about the Internet activities of individuals involved in a violent crime.

• Computers are a particularly important source of information when offenders locate or target victims through the Internet, effectively making the computer an instrument of violent crime.

• In these situations, the computer may hold evidence that relates directly to the planning and commission of the crime.

• Data from Internet service providers used by the victim or suspect can also help determine their activities around the time of the crime, their whereabouts, and their identity.

The Role of Computers in Violent Crime

1. The Role of Computers in Violent Crime

Mobile Devices• Mobile devices may contain information about communications as well

as audio or video recordings relating to an offense.• Mobile devices may also provide the location of victims and suspects at

key times.

Personal Computers• A victim’s computer may contain a diary and frequently retain

sent and received e-mails that offer a unique view into his/her personal life.

• This can include evidence of fantasies, criminal activity, and clandestine relationships that even friends and family do not know about.

1. The Role of Computers in Violent Crime

Private Networks• Privately owned networks can also be a rich source of

information when investigating violent crimes. These networks usually contain a higher concentration of digital information about the individuals who use them, making it easier to find and collect relevant digital data than on the global Internet.

Intent and Motive• In addition to providing concrete leads, a murderer’s computer

or mobile device may disprove offender statements, show his intent to commit a crime, and uncover evidence of staging such as a fake suicide note created after the victim’s death.

2.Processing The Digital Crime Scene• Violent crime investigations are generally messy and

complicated because of the extreme emotions, concealment behavior, and various types of evidence involved.

• These investigations require a methodical approach to ensure that all relevant items are recognized, collected, and examined properly.

Techniques for Processing:

1. Authorization2. Preparation: Make a Plan, Follow the Plan3. Crime Scene Survey and Documentation4. Enterprise Networks as Evidence

2.Processing The Digital Crime Scene

Authorization• When investigating violent crimes, there is sometimes

a need for instant action. For this reason, under crucial circumstances, law enforcement personnel may be permitted to conduct searches without a warrant.

• However, even in a homicide, a warrant is required for an in-depth search of a suspect’s possessions, and digital investigators need consent or some other form of authorization to obtain information from computers belonging to the victim or employers

2.Processing The Digital Crime Scene Preparation: Make a Plan, Follow the Plan

• To help deal with the messy nature of violent crime scenes and to reduce the risk of mistakes or missed opportunities, it is important to plan the preservation of digital evidence carefully and execute the plan meticulously on scene.

• As part of the preparation, when processing the digital crime scene in a violent crime investigation, it is important to have standard operating procedures to ensure that all digital evidence and findings can hold up under close scrutiny.

2.Processing The Digital Crime Scene Crime Scene Survey and Documentation

• It is useful to create hand-drawn or computer-generated diagrams of the crime scene and important items of evidence.

• An overview diagram of the premise that is being surveyed can provide a rough map of where important items were located. Labeling each room or area with a unique letter and assigning a unique number to each item of evidence enable digital investigators to keep track of where each item was found in the crime scene.

• In case of violent crime investigation, it may not be clear what information will be important, and which will be needed to continue further ,so initially digital investigators should obtain as much digital evidence as is feasible from the victim’s and suspect’s home, workplace, and network service providers and it is generally advisable to preserve every item of digital evidence.

2.Processing The Digital Crime Scene Enterprise Networks as Evidence

• When dealing with an enterprise as a source of evidence, it is generally necessary to interview suspects and system administrators for information about the computers and networks, and their uses.

• The goal of this information gathering process is to develop a list of items to be preserved. When it is necessary to rely on others to collect specific data, those people should be supervised closely to ensure that the data is collected and documented properly.

• In some cases it may be necessary to segregate or otherwise protect personally identifiable information or intellectual property to prevent it from being disclosed to unauthorized persons.

• Substantial amounts of information about victims and suspects in violent crime investigations may be found on computer systems in their workplaces also offenders can get plenty of information about victims through these IT systems. Also evidence can be intentionally destroyed via an enterprise network. That is why care should be taken while gathering the evidences.

3.Investigative Reconstruction• The investigative reconstruction process involves pulling all

evidence together and letting it speak for itself. • It is meant to be an objective learning exercise, without an

expected outcome. It helps investigators to organize a complex case and develop a greater understanding of the evidence and crime.

• While reconstructing evidence surrounding a violent crime, it is generally helpful to create a timeline of events from digital evidence, including usage of personal and work computers, mobile devices, and corporate systems of employers.

• When in doubt about digital evidence, conduct interviews and perform experiments on the evidence to gain additional insight into the evidence.

3.Investigative Reconstruction

Aspects of investigative reconstruction

1. Victimology

2. Offender Behavior

3. Crime Scene Characteristics

3.Investigative Reconstruction Victimology

• There may be certain aspects of a victim’s life or behavior that put him or her at higher risk of being attacked or killed.

• Victimology is the assessment of the victim as they relate to the offender, the crime scene, the incident, and the criminal justice system.

• Computers can help expand an investigator’s understanding of the victim, including the dangers in his/her life, why the offender chose him/her.

• All these help provide context, connections, and investigative direction. If we can understand how and why an offender has selected a victim(s) he/she has a relationship with, then we may also be able to establish a relational link of some kind between the victim(s) and that offender.

3.Investigative Reconstruction

Offender Behavior

• When investigating suspects of a violent crime, it is important to look for behaviors that leave digital traces.

• Digital investigators should examine computers, mobile devices, and removable storage media for such information.

3.Investigative Reconstruction Crime Scene Characteristics• Fundamentally, there are two categories of crime scene ,1)

primary and 2)secondary• In a violent crime, the primary crime scene is where the

violent offense occurred • And the secondary crime scenes may include where the victim

was captured and where the offender discarded clothes, weapons, and digital devices. They use Computers and mobile devices for committing crime.

• But different offenders can use the same method of approach or control for very different reasons, so it is not possible to make broad generalizations on the basis of these crime scene characteristics.

3.Investigative Reconstruction

Crime Scene Characteristics• Therefore, it is necessary to crime scene characteristics in

unison, determining how they influence and relate to each other.

• It is also important to remember that an offender is rarely in complete control—there can be unexpected occurrences or victims can react unpredictably.

• Investigators should examine the victim-offender interactions and the events surrounding the crime to determine how an offender reacted to events that he/she could not have anticipated.

Digital Evidence as Alibi

Contents:

1. Investigating an Alibi

2. Time as Alibi

3. Location as Alibi

Digital Evidence as AlibiInvestigating an Alibi• When investigating an alibi that depends on digital evidence,

the first step is to judge the reliability of the information on the computers and networks involved.

• A test system should resemble the actual system closely enough to enable investigators to recreate the alibi that they are trying to verify. If a test system is not available, it is crucial to back up all potential digital evidence before attempting to recreate an alibi.

• Although absence of evidence is not necessarily evidence of absence, an alibi can be severely weakened by a lack of expected digital evidence.

• An interesting aspect of investigating an alibi is that no amount of supporting evidence can prove conclusively that an individual was in a specific place at a specific time.

Gender Offenders on the Internet• The ability of criminals to acquire victims, gather information,

wait in cyberspace, protect or alter their identity, and communicate with other offenders makes the Internet an attractive setting for these individuals.

• The Internet is giving criminals greater access to victims, extending their reach from a limited geographical area to victims all around the world, the Internet contains a significant amount of information about potential victims.

• Online dating sites provide the most obvious example of the kinds of personal information that individuals disclose on the Internet including photographs, their age, and geographic region. Although these dating sites were created for a valid purpose, they provide a target rich environment that offenders have not ignored.

Gender Offenders on the Internet• Offenders also use dating sites to seek out other similar

minded individuals to validate their interests, and to gain access to more victims and child pornography.

• Even people who use the Internet for purposes other than meeting a partner disclose personal information unintentionally that a malicious individual can use against them.

• The Internet allows offenders to groom victims, developing sufficient trust to engage in cybersex or even meet in the physical world.

• Internet provides privacy and safety to everyone who uses it, so offenders can alter or hide their identity. Age, gender, and physical appearance are all flexible on the Internet, enabling offenders to further their own fantasies and portray themselves in a way that will interest their chosen victim.

Gender Offenders on the Internet• We must consider investigative guidelines and

insights for conducting investigations of sex offenders on the Internet, and discusses related legal issues.

• An overview of investigating this type of crime is provided to help digital investigators and digital evidence examiners integrate the techniques presented.

• Ultimately, investigators and examiners must depart from the finite knowledge and creatively apply what they have learned to new situations in the cases they encounter.

Computer Intrusions

Different aspects:1. How Computer Intruders Operate2. Investigating Computer Intrusions 3. Forensic Preservation of Volatile Data4. Post-Mortem Investigation of a Compromised

System5. Investigation of Malicious Computer Programs6. Investigative Reconstruction

Computer Intrusions

1.How Computer Intruders Operate1.1 Goals1.2 Basic Methodology:1.3 Classic Computer Intrusion Tactics 1.3.1 Direct Attack Methods 1.3.2 Social Engineering1.4 Current Computer Intrusion Tactics

Computer Intrusions

Computer Intrusions

Computer Intrusions

Computer Intrusions