Introduction

In the preceding chapter, we turned our focus from an analysis and explanation of cybercrime, who s involved in perpetrating such crimes, and underlying computer and networking security basics to investigate what s involved in countering potential threats namely, we covered various aspects and areas in which it s essential to implement system, network, and communications security. Unfortunately, our security measures won t always work. Another important part of preparing for potential threats and related risks of criminal mischief, intrusion, or attack is being prepared to deal with the aftermath of a cybercrime and to start gathering the information that will be necessary to build a case for prosecution.

Once an attack has occurred or a system or network has been compromised, it s essential to be able to sift through the evidence of what s happened. From a technical information technology perspective, this means knowing how to find, recognize, and locate the visible evidence of a cybercrime. From a law enforcement perspective, this means knowing how to handle such evidence to make sure it will be admissible in court if necessary. However, these roles overlap somewhat. A good investigator also needs to know the technicalities of where and how evidence can be located, to properly put together the offense report and help the prosecutor formulate questions for witnesses. Likewise, the IT professional needs an understanding of how evidence must be treated to preserve its integrity in the eyes of the law.

In this chapter, we focus primarily on the former activity; we introduce various sources...