
369
Appendix I
Questions That Every Cyber
Investigator Should Ask;
before, during, and after
an Investigation
Following the Best Practice for the Seizure of Electronic Evidence as set forth by the National
High Tech Crime Unit, published by the Association of Chief Police Offi cers.
In a preliminary stage that should precede the “Discovery of Computer or Digital Equipment
to be Seized,” several items need to be determined before launching the investigation. ese pre-
liminary steps should include:
1. e computer that will become evidence, what is the role in this case?
2. Is it the suspect’s computer? Is it a victim’s computer?
3. Is it a computer ...