2.4 Summary

Despite being a new field, great advancements have been made in computer crime investigation. Powerful evidence processing tools have been developed and there is a move towards standardization.

One of the fundamental purposes of categories described in this chapter is to emphasize the role of computers in crime and to give guidance for dealing with computers in that role. These categories can be used to develop procedures for dealing with digital evidence and investigating crimes involving computers. Early categories were necessarily general and as the categories were refined, guidelines were developed to help investigators deal with electronic and digital evidence. These guidelines are still in their early stages, especially with regard to digital evidence. More detailed guidelines for dealing with information as evidence, also known as digital evidence, are presented throughout this book.

The language described in this chapter both enables and limits our ability to describe and interpret digital evidence. This language is useful for developing investigative and evidence-processing procedures but does not include other important aspects of investigating this type of crime. Concepts and techniques that are helpful for interpreting digital evidence, discerning patterns of behavior, understanding motives, generating investigative leads, linking cases, and develop trial strategies are presented in Chapters 4 and 5.