1. UNIT III

2. Violent Crime and Digital Evidence
Violent crimes are challenging to investigate not only because of the severe behavior that is involved, but also the complexity of formative events and relationships.
Information is key to determining and then understanding the victim-offender relationships and to developing ongoing investigative strategy.
Consequently, any detail gathered from the digital evidence can be important, and digital investigators must develop the ability to prioritize what can be overwhelming amounts of evidence.
loss or mishandling of exonerating digital evidence could result in an innocent person being convicted. To avoid such problems in a violent crime investigation, training is needed to ensure that digital evidence is handled properly and interpreted correctly.

3. 1. The Role of Computers in Violent Crime
Digital investigators can use information gleaned from many forms of digital evidence to find likely suspects, uncover previously unknown crimes, develop leads, build a more complete timeline and reconstruction of events, and check the accuracy of witness statements and offender statements.

4. 1. The Role of Computers in Violent Crime
Cyber trails
Computers may contain useful information about the Internet activities of individuals involved in a violent crime.
Computers are a particularly important source of information when offenders locate or target victims through the Internet, effectively making the computer an instrument of violent crime.
In these situations, the computer may hold evidence that relates directly to the planning and commission of the crime.
Data from Internet service providers used by the victim or suspect can also help determine their activities around the time of the crime, their whereabouts, and their identity.

5. The Role of Computers in Violent Crime

6. 1. The Role of Computers in Violent Crime
Mobile Devices
Mobile devices may contain information about communications as well as audio or video recordings relating to an offense.
Mobile devices may also provide the location of victims and suspects at key times.
Personal Computers
A victim’s computer may contain a diary and frequently retain sent and received s that offer a unique view into his/her personal life.
This can include evidence of fantasies, criminal activity, and clandestine relationships that even friends and family do not know about.

7. 1. The Role of Computers in Violent Crime
Private Networks
Privately owned networks can also be a rich source of information when investigating violent crimes. These networks usually contain a higher concentration of digital information about the individuals who use them, making it easier to find and collect relevant digital data than on the global Internet.
Intent and Motive
In addition to providing concrete leads, a murderer’s computer or mobile device may disprove offender statements, show his intent to commit a crime, and uncover evidence of staging such as a fake suicide note created after the victim’s death.

8. 2.Processing The Digital Crime Scene
Violent crime investigations are generally messy and complicated because of the extreme emotions, concealment behavior, and various types of evidence involved.
These investigations require a methodical approach to ensure that all relevant items are recognized, collected, and examined properly.
Techniques for Processing:
Authorization
Preparation: Make a Plan, Follow the Plan
Crime Scene Survey and Documentation
Enterprise Networks as Evidence

9. 2.Processing The Digital Crime Scene
Authorization
When investigating violent crimes, there is sometimes a need for instant action. For this reason, under crucial circumstances, law enforcement personnel may be permitted to conduct searches without a warrant.
However, even in a homicide, a warrant is required for an in-depth search of a suspect’s possessions, and digital investigators need consent or some other form of authorization to obtain information from computers belonging to the victim or employers

10. 2.Processing The Digital Crime Scene
Preparation: Make a Plan, Follow the Plan
To help deal with the messy nature of violent crime scenes and to reduce the risk of mistakes or missed opportunities, it is important to plan the preservation of digital evidence carefully and execute the plan meticulously on scene.
As part of the preparation, when processing the digital crime scene in a violent crime investigation, it is important to have standard operating procedures to ensure that all digital evidence and findings can hold up under close scrutiny.

11. 2.Processing The Digital Crime Scene
Crime Scene Survey and Documentation
It is useful to create hand-drawn or computer-generated diagrams of the crime scene and important items of evidence.
An overview diagram of the premise that is being surveyed can provide a rough map of where important items were located. Labeling each room or area with a unique letter and assigning a unique number to each item of evidence enable digital investigators to keep track of where each item was found in the crime scene.
In case of violent crime investigation, it may not be clear what information will be important, and which will be needed to continue further ,so initially digital investigators should obtain as much digital evidence as is feasible from the victim’s and suspect’s home, workplace, and network service providers and it is generally advisable to preserve every item of digital evidence.

12. 2.Processing The Digital Crime Scene
Enterprise Networks as Evidence
When dealing with an enterprise as a source of evidence, it is generally necessary to interview suspects and system administrators for information about the computers and networks, and their uses.
The goal of this information gathering process is to develop a list of items to be preserved. When it is necessary to rely on others to collect specific data, those people should be supervised closely to ensure that the data is collected and documented properly.
In some cases it may be necessary to segregate or otherwise protect personally identifiable information or intellectual property to prevent it from being disclosed to unauthorized persons.
Substantial amounts of information about victims and suspects in violent crime investigations may be found on computer systems in their workplaces also offenders can get plenty of information about victims through these IT systems. Also evidence can be intentionally destroyed via an enterprise network. That is why care should be taken while gathering the evidences.

13. 3.Investigative Reconstruction
The investigative reconstruction process involves pulling all evidence together and letting it speak for itself.
It is meant to be an objective learning exercise, without an expected outcome. It helps investigators to organize a complex case and develop a greater understanding of the evidence and crime.
While reconstructing evidence surrounding a violent crime, it is generally helpful to create a timeline of events from digital evidence, including usage of personal and work computers, mobile devices, and corporate systems of employers.
When in doubt about digital evidence, conduct interviews and perform experiments on the evidence to gain additional insight into the evidence.

14. 3.Investigative Reconstruction
Aspects of investigative reconstruction
Victimology
Offender Behavior
Crime Scene Characteristics

15. 3.Investigative Reconstruction
Victimology
There may be certain aspects of a victim’s life or behavior that put him or her at higher risk of being attacked or killed.
Victimology is the assessment of the victim as they relate to the offender, the crime scene, the incident, and the criminal justice system.
Computers can help expand an investigator’s understanding of the victim, including the dangers in his/her life, why the offender chose him/her.
All these help provide context, connections, and investigative direction. If we can understand how and why an offender has selected a victim(s) he/she has a relationship with, then we may also be able to establish a relational link of some kind between the victim(s) and that offender.

16. 3.Investigative Reconstruction
Offender Behavior
When investigating suspects of a violent crime, it is important to look for behaviors that leave digital traces.
Digital investigators should examine computers, mobile devices, and removable storage media for such information.

17. 3.Investigative Reconstruction
Crime Scene Characteristics
Fundamentally, there are two categories of crime scene ,1) primary and 2)secondary
In a violent crime, the primary crime scene is where the violent offense occurred
And the secondary crime scenes may include where the victim was captured and where the offender discarded clothes, weapons, and digital devices. They use Computers and mobile devices for committing crime.
But different offenders can use the same method of approach or control for very different reasons, so it is not possible to make broad generalizations on the basis of these crime scene characteristics.

18. 3.Investigative Reconstruction
Crime Scene Characteristics
Therefore, it is necessary to crime scene characteristics in unison, determining how they influence and relate to each other.
It is also important to remember that an offender is rarely in complete control—there can be unexpected occurrences or victims can react unpredictably.
Investigators should examine the victim-offender interactions and the events surrounding the crime to determine how an offender reacted to events that he/she could not have anticipated.

19. Digital Evidence as Alibi
Contents:
Investigating an Alibi
Time as Alibi
Location as Alibi

20. Digital Evidence as Alibi
Investigating an Alibi
When investigating an alibi that depends on digital evidence, the first step is to judge the reliability of the information on the computers and networks involved.
A test system should resemble the actual system closely enough to enable investigators to recreate the alibi that they are trying to verify. If a test system is not available, it is crucial to back up all potential digital evidence before attempting to recreate an alibi.
Although absence of evidence is not necessarily evidence of absence, an alibi can be severely weakened by a lack of expected digital evidence.
An interesting aspect of investigating an alibi is that no amount of supporting evidence can prove conclusively that an individual was in a specific place at a specific time.

21. Gender Offenders on the Internet
The ability of criminals to acquire victims, gather information, wait in cyberspace, protect or alter their identity, and communicate with other offenders makes the Internet an attractive setting for these individuals.
The Internet is giving criminals greater access to victims, extending their reach from a limited geographical area to victims all around the world, the Internet contains a significant amount of information about potential victims.
Online dating sites provide the most obvious example of the kinds of personal information that individuals disclose on the Internet including photographs, their age, and geographic region. Although these dating sites were created for a valid purpose, they provide a target rich environment that offenders have not ignored.

22. Gender Offenders on the Internet
Offenders also use dating sites to seek out other similar minded individuals to validate their interests, and to gain access to more victims and child pornography.
Even people who use the Internet for purposes other than meeting a partner disclose personal information unintentionally that a malicious individual can use against them.
The Internet allows offenders to groom victims, developing sufficient trust to engage in cybersex or even meet in the physical world.
Internet provides privacy and safety to everyone who uses it, so offenders can alter or hide their identity. Age, gender, and physical appearance are all flexible on the Internet, enabling offenders to further their own fantasies and portray themselves in a way that will interest their chosen victim.

23. Gender Offenders on the Internet
We must consider investigative guidelines and insights for conducting investigations of sex offenders on the Internet, and discusses related legal issues.
An overview of investigating this type of crime is provided to help digital investigators and digital evidence examiners integrate the techniques presented.
Ultimately, investigators and examiners must depart from the finite knowledge and creatively apply what they have learned to new situations in the cases they encounter.

24. Computer Intrusions Different aspects: How Computer Intruders Operate
Investigating Computer Intrusions
Forensic Preservation of Volatile Data
Post-Mortem Investigation of a Compromised System
Investigation of Malicious Computer Programs
Investigative Reconstruction

25. Computer Intrusions
1.How Computer Intruders Operate 1.1 Goals 1.2 Basic Methodology: 1.3 Classic Computer Intrusion Tactics Direct Attack Methods Social Engineering 1.4 Current Computer Intrusion Tactics

26. Computer Intrusions

27. Computer Intrusions

28. Computer Intrusions

29. Computer Intrusions