Introduction

Experienced investigators know that, contrary to the philosophy of the modern murder mystery, discovering who dun it is not the end of an investigation it s only the beginning. In the previous chapter, we discussed how to collect and preserve evidence. Although in a cybercrime case this can be one of the most difficult aspects of the investigation, it s still not the final step. A criminal investigation, in order to result in prosecution of the offender, must culminate in the building of a solid case file containing documentation of all the evidence that can be used to obtain a conviction in court.

Constructing a criminal case is a long, often complex process. The more technical the facts of the case, the more difficult it is to build a good case that presents the evidence in a way that can be thoroughly understood by the following key players:

• The prosecuting attorney or a grand jury (one of which, depending on the level of the offense and the governing code of criminal procedure, will make the decision as to whether to bring the case to trial)

• The trial jury (which ultimately decides guilt or innocence in a felony case and sometimes sets the penalty)

• The judge (who may decide guilt or innocence in a misdemeanor case and who often is responsible for setting the penalty even in cases where guilt or innocence is decided by a jury)

The investigator is not the only person involved in constructing the case, but he or she...