Chapter 8
Investigative Reconstruction with Digital Evidence
Objectives
On completion of this chapter, the student will:
– Be aware that crime is not always committed in a straightforward manner.
– Recognize that investigative reconstruction refers to the systematic process of piecing
together evidence.
– Recognize the need to conduct equivocal forensic analysis to assure that evidence is
evaluated objectively.
Chapter Guide
Investigatory reconstruction provides a methodology for gaining a better understanding of a
crime and focusing an investigation. Objectively reviewing available evidence provides a
greater understanding of the case.
Multiple Choice Questions
1. The process of evaluating available evidence objectively, independent of the
interpretations of others, to determine its true meaning is referred to as:
2. The words that an offender uses on the Internet, the tools that an offender uses online,
and how an offender conceals his identity and criminal activity are referred to in the text
as:
3. Investigative reconstruction is composed of three different forms. Which of the following
is NOT one of those three forms?
4. Creating a histogram of times to reveal periods of high activity is an example of which
form of investigative reconstruction?
5. The investigation and study of victim characteristics is known as:
6. Why should victimology include a thorough search of the Internet for cybertrails?
7. The type of report that is a preliminary summary of findings is known as:
8. According to the text, the distinguishing features of a crime scene as evidenced by the
e victim and the offense location are known
as:
9. In crimes against individuals the ______ period leading up to the crime often contains the
most important clues regarding the relationship between the offender and the victim.
10. One of the most important things to establish when a computer is directly involved in the
commission of a crime is:
11. An example of online behavior that puts an individual at higher risk for cyberstalking is:
12. In the movie Home Alone one of the burglars would always turn the water on in the sinks
so that the house would be flooded when the owners returned. In terms of crime scene
characteristics, this is an example of:
13. The totality of choices an offender makes during the commission of a crime are referred
to as:
14. Because seemingly minor details regarding the offender can be important, investigators
should get into the habit of contemplating which of the following:
15. One reason digital investigators write threshold assessments more often than full reports
is because:
True or False Questions
1. e systematic process of piecing together
evidence and information gathered during an investigation to gain a better understanding
of what transpired between the victim and the offender during a crime.
2. Investigative reconstruction can be used to locate concealed evidence.
3. The functional form of investigative r
4. Minor details regarding the offender are unimportant, and can safely be ignored.
5. The temporal form of investigative reconstruction helps identify event sequences and
patterns.
6. The machine with an old operating system, no patches, and many services running,
located on an unprotected network, containing valuable information, and with a history of
intrusions or intrusion attempts, is at low risk of being broken into.
7. Victimology is the investigation and study of victim characteristics.
8. When assessing the risk of a target computer, investigators should determine if the
offender needed a high level of skill.
9. Different offenders can use the same method of approach for control for very different
reasons; however, it is possible to make reliable generations on the basis of individual
crime scene characteristics.
10. When a computer is the target of an attack, it is also useful to determine if the system was
at high or low risk of being targeted.
11. A threshold assessment report may have a similar structure to a full investigative report
but includes more details and has firmer conclusions based on all the evidence available.
12. Threshold assessments have eliminated the need for digital investigators to write full
reports.
13. Among the more informative aspects of the offender-victim relationships are victim risk
and the effort than an offender was willing to make to access a specific victim.
14. Although it is possible that the In
not necessary for victimology to include a thorough search for cybertrails.
15. Forensic analysis and reconstruction only include evidence that was left at a crime scene
and are intrinsically limited.
Essay Questions
1. Explain why it can be difficult to determine if someone took a copy of a digital file.
eapon is significant to an investigation.
Scenario
Two of three Porcine brothers had their houses systematically destroyed by a large Lycan. In fear
for their lives, they sought shelter with a third brother. Suspecting that his house would also
come under attack, he reinforced the structure and added certain countermeasures that would
come into play only if the perimeter was breached. Indeed, an attack on his house was mounted,
ng in the demise of the intruder.