Chapter 1: Types of Computer-Based Investigations

Criminal investigations address offenses including cyberstalking, cyberbullying, illegal content distribution, and other cybercrimes that fall under law enforcement jurisdiction, while corporate investigations focus on internal misconduct, insider threats, and proprietary information theft requiring specialized private sector approaches. The chapter emphasizes the central role of digital forensic examiners in systematically identifying, preserving, and analyzing electronic evidence while maintaining strict adherence to chain of custody protocols essential for courtroom admissibility. First responders, field investigators, and crime scene technicians each carry distinct responsibilities in the evidence collection process, and improper handling can compromise an entire case regardless of investigative merit. Key sources of digital evidence are examined across multiple platforms, including peer-to-peer file sharing networks, USENET newsgroups, social media accounts, and Internet of Things devices, each presenting unique technical and legal challenges. The chapter grounds these concepts in documented case studies such as the BTK Killer investigation, the Silk Road prosecution, and the San Bernardino terrorist attack, demonstrating how digital forensics provided decisive evidence in complex, high-stakes prosecutions. Legal frameworks governing digital evidence collection are explored, including the requirements for obtaining search warrants and subpoenas under Fourth Amendment protections, establishing the lawful boundaries within which forensic examination must operate. By connecting procedural responsibilities, evidence sources, legal constraints, and real-world applications, this chapter establishes the comprehensive foundation necessary for understanding how digital forensics functions within both criminal justice and corporate security contexts.