With increasing mobility, crimes generate growing tracking and analysis problems for computer crime investigators. Developing a game plan makes for productive case management. Identifying the Operating System. Visualizing and Analyzing the Evidence. However odd it may sound, knowing which crime produced the evidence trail becomes the crucial first step.
Any investigation has to start with a theory of the case.
The true nature of the crime may be latent at the case's inception. Clifford Stoll didn't know what was happening at the beginning of The Cuckoo's Egg. He had a minor discrepancy in the amount of account charges on his system. Later, only after dogged investigation and observation did he learn that an international espionage ring was prowling his Unix boxes. Assembling the preliminary facts to assess and to categorize the crime will provide a blueprint for subsequent investigation.