Cybercrime Investigation and Digital Evidence

Introduction and Context

Cybercrime investigations concern conduct in which computers, networks, mobile devices, online services, or digital data are the target, instrument, or environment of an offence. Examples include unauthorised access, identity theft, online fraud, malware distribution, cyberstalking, unlawful interception, extortion, and the misuse of confidential information. Unlike many physical forms of evidence, digital evidence can be copied without visible degradation, altered remotely, distributed across several jurisdictions, encrypted, automatically overwritten, or generated by third-party systems.

These characteristics make cybercrime investigation both technically demanding and legally sensitive. An investigator must not merely locate information; the investigator must show that it was obtained lawfully, preserved reliably, interpreted competently, and presented in a form that permits a court to assess its relevance and authenticity. Technical capability does not replace due process. A search conducted without lawful authority, or a sound forensic conclusion based on poorly documented handling, may be excluded or given little weight.

This chapter presents a practical framework for lawful search and seizure, preservation, forensic imaging, chain of custody, metadata and log analysis, cloud evidence, admissibility, and expert testimony. Specific rules vary by jurisdiction. Accordingly, investigators should consult applicable constitutions, statutes, procedural codes, evidence rules, telecommunications legislation, privacy and data-protection law, and judicial precedent before acting.

Learning Objectives

By the end of this chapter, a learner should be able to:

1. Explain the nature and evidential value of digital evidence.
2. Distinguish lawful search, seizure, preservation, and examination.
3. Describe sound procedures for forensic acquisition and integrity verification.
4. Construct and evaluate a chain-of-custody record.
5. Interpret metadata, system artefacts, and logs cautiously.
6. Identify special legal and technical issues in cloud investigations.
7. Explain admissibility, authenticity, relevance, reliability, and expert testimony.
8. Apply privacy, proportionality, and due-process principles to an investigation.

1. The Nature of Digital Evidence

Digital evidence is information of potential probative value stored or transmitted in digital form. It may be found on a laptop, smartphone, removable drive, server, vehicle system, router, cloud platform, wearable device, or application account. It may also exist as transient data in volatile memory, active network connections, running processes, or temporary files.

A useful classification is:

Digital evidence is not automatically conclusive. A file bearing a person’s name does not prove that the person created it. A source IP address may identify a connection or subscriber but not necessarily the individual user. A timestamp may represent creation, modification, synchronisation, or server processing time. Sound conclusions therefore require corroboration, knowledge of system operation, and explicit recognition of uncertainty.

1.1 Evidence, information, and exhibits

Information becomes evidence when it is collected and relied upon to prove or disprove a fact in issue. An exhibit is an item formally introduced into proceedings. The original device, a forensic image, a verified export, a screenshot, and an investigator’s report may all have different evidential roles. The investigator should document what was collected, from where, by which method, and whether the item is an original, a forensic duplicate, or a derived representation.

1.2 The principal attributes of reliable digital evidence

Reliable digital evidence should be:

• Relevant: logically connected to a fact in issue.
• Authentic: shown to be what the party claims it is.
• Complete: significant context, including potentially exculpatory material, is not selectively omitted.
• Reliable: produced and interpreted through dependable methods.
• Legally obtained: collected under valid authority and within its scope.
• Preserved: protected from unauthorised alteration and documented throughout handling.
• Explainable: capable of being understood by the court, including its limitations.

2. Lawful Investigation: Authority, Scope, and Proportionality

Before accessing or seizing digital material, an investigator should identify the legal authority for the proposed action. Depending on the jurisdiction and circumstances, authority may include a warrant, judicial order, statutory power, consent, an incident-response agreement, a contractual investigation provision, or a recognised emergency power. Each has limits.

A lawful investigation normally requires attention to four questions:

1. Authority: Who authorised the search, seizure, disclosure, or examination?
2. Particularity: What person, place, account, device, data category, or offence is covered?
3. Necessity and proportionality: Is the intrusion justified by the seriousness and evidential value of the suspected conduct?
4. Procedure: Were required notices, approvals, records, and safeguards followed?

A warrant to search a specified device for evidence of a particular offence should not automatically be treated as permission to explore every unrelated account or personal file. Where a device contains material belonging to several people, investigators should apply minimisation procedures and segregate irrelevant or privileged content.

2.1 Search, seizure, preservation, and examination

These concepts should not be confused:

• Search is the process of looking for or accessing information.
• Seizure is the lawful taking of possession or control of an item or data.
• Preservation is the act of preventing alteration or deletion while legal authority for disclosure or examination is obtained.
• Examination is the technical analysis of collected material.
• Production or disclosure is the provision of evidence to an authorised investigator, court, or other legal recipient.

A preservation request may prevent a provider from deleting specified data, but it may not itself authorise investigators to obtain or examine the content. Conversely, physical seizure of a computer does not necessarily authorise access to every cloud account visible on that computer.

2.2 Consent

Consent must be voluntary, informed, and given by a person with actual or apparent authority. It should be recorded clearly, including what was offered, what was explained, the scope of access, and any limitations. Consent obtained through coercion, deception prohibited by law, or misunderstanding may be challenged. A workplace administrator may have authority over organisational equipment but not necessarily over an employee’s private account or personal device.

2.3 Privacy and due process

Digital devices contain intimate and unrelated information: health records, family communications, financial details, legal advice, photographs, and information about third parties. Investigators should use the least intrusive lawful method reasonably capable of achieving the investigative purpose. Safeguards may include targeted search terms, independent review for privilege, access controls, encryption, retention limits, redaction, and deletion or return of irrelevant copies.

Due process also includes fairness to the suspect. Investigators should preserve exculpatory as well as incriminating material, avoid overstating inferences, disclose relevant methodology, and maintain records that permit meaningful challenge by the defence.

3. Initial Response and Preservation

The first responder may be a police officer, digital forensic examiner, corporate security employee, or incident-response specialist. The first priority is to protect people and prevent ongoing harm. The second is to identify legal authority and preserve potential evidence.

An initial response should generally include:

1. Confirming the incident and securing the scene or environment.
2. Recording date, time, location, persons present, and visible device state.
3. Identifying powered-on, powered-off, encrypted, networked, or damaged devices.
4. Preventing remote tampering where legally and technically appropriate.
5. Consulting a qualified examiner before changing device state.
6. Photographing connections, screens, labels, and physical condition.
7. Deciding whether volatile data must be captured before shutdown.
8. Isolating devices from networks using a documented method when appropriate.
9. Packaging, labelling, transporting, and storing items securely.

There is no universal rule that a device should always be unplugged or always left running. If a live system contains encryption keys, malware processes, or active network sessions, live acquisition may be valuable. However, live interaction changes data and may expose investigators to legal risks, remote-wipe commands, or malicious code. The decision should be justified, authorised, and documented.

3.1 Preservation notices and legal holds

Organisations should issue preservation instructions when litigation or investigation is reasonably anticipated. A legal hold should identify custodians, systems, relevant date ranges, data categories, and suspension of routine deletion where lawful. In a cloud environment, preservation may require rapid communication with several providers because retention periods and technical capabilities differ.

4. Forensic Acquisition and Imaging

Forensic acquisition aims to create a reliable working copy of data while preserving the original source. A physical image attempts to capture the addressable storage media, including allocated and unallocated areas. A logical acquisition collects selected files, directories, application data, or account content. A targeted collection gathers only specified data using defined criteria.

The correct method depends on legal scope, device type, encryption, operational needs, and proportionality. Physical imaging is not always possible or necessary, particularly for cloud services, modern mobile devices, solid-state storage, or large enterprise systems.

4.1 Write protection and acquisition controls

Where possible, examiners use hardware or software write-blocking to prevent the examination system from altering the source media. They record the device make, model, serial number, storage capacity, connection method, tool versions, settings, date, time, and operator identity. The source is not used casually for browsing.

A typical acquisition workflow is:

1. Verify authority and define scope.
2. Identify and photograph the source.
3. Record state and connections.
4. Apply write protection or an equivalent control.
5. Acquire using validated tools and a documented method.
6. Calculate integrity values for the source or acquired object where technically appropriate.
7. Verify the acquisition and preserve the master copy.
8. Conduct analysis on a working copy.
9. Record all significant actions and findings.

4.2 Hash values

A cryptographic hash is a fixed-length digest calculated from digital data. For a specified algorithm and input, the same unchanged input should produce the same digest. A hash can help demonstrate that a forensic image or exported file has not changed since calculation. It does not prove who created the content, when it was created, or that the content itself is truthful.

Hash comparison is meaningful only when the algorithm, input, calculation process, and result are documented. Modern practice should use a well-regarded cryptographic hash algorithm appropriate to the jurisdiction and institutional policy. Older algorithms may remain useful for comparison with legacy records but should not be treated as sufficient security against every form of deliberate collision attack.

4.3 Imaging limitations

A forensic image may not capture information held by a provider, data protected by hardware encryption, deleted data that has been reclaimed by a solid-state drive, or content inaccessible without credentials. An image is therefore a method of collection, not a guarantee of completeness. Reports should state what was and was not acquired.

5. Chain of Custody and Evidence Management

Chain of custody is the chronological record of possession, control, transfer, examination, storage, and disposition of evidence. Its purpose is to show that the item presented is materially the same item collected and that opportunities for unauthorised alteration were controlled.

A sound record normally includes:

Every transfer should have a reason and an identifiable sender and recipient. Evidence should be stored with access controls and audit logs. A minor clerical error does not automatically destroy admissibility, but unexplained gaps, inconsistent descriptions, broken seals, or unauthorised access can undermine reliability and weight.

6. Metadata, Artefacts, and Timeline Analysis

Metadata is data about data. File metadata can include names, paths, sizes, ownership information, creation and modification fields, camera settings, GPS coordinates, and application identifiers. System artefacts may include link files, thumbnails, shell records, browser databases, recycle-bin entries, prefetch data, authentication records, and application caches.

Metadata must be interpreted in context. A file’s “creation” time may reflect the time it was copied to a particular device rather than the time its content was first created. Time zones, daylight-saving changes, clock drift, synchronisation, virtual machines, and differing timestamp conventions can produce apparent contradictions.

A timeline should identify:

• the source of each event;
• the timestamp and time zone;
• whether the time is device, server, or examiner time;
• the action represented, such as access, modification, login, or transmission;
• the reliability and limitations of the artefact; and
• corroborating or conflicting evidence.

A timeline is an analytical model, not a direct recording of human behaviour. It can show that an account authenticated from a device at a particular time, but it may not establish who was physically operating it.

7. Log Review and Correlation

Logs are records generated by operating systems, applications, security tools, routers, identity providers, firewalls, and cloud services. Investigators should understand the logging system before drawing conclusions. Important questions include:

• What event causes the entry to be generated?
• Is logging complete or sampled?
• Can administrators modify or delete entries?
• Which clock and time zone are used?
• Are entries synchronised through a time service?
• How long are logs retained?
• What does an IP address represent in this environment?
• Are records duplicated, delayed, or transformed during collection?

Correlation combines records from multiple sources. For example, an identity-provider login, endpoint process event, firewall connection, and cloud download record may support a stronger inference together than any single entry alone. Correlation requires normalisation of time, identifiers, and event meanings. Investigators should preserve original logs and distinguish them from parsed or filtered exports.

A source IP address is not equivalent to a person. Network address translation, shared networks, virtual private networks, public Wi-Fi, compromised devices, proxies, and dynamic allocation may separate the address from the actual actor. Attribution should therefore be expressed proportionately, such as “the account was accessed from an address assigned to...” rather than “the accused committed the access.”

8. Cloud and Hosted Evidence

Cloud evidence is data held or processed by a service provider rather than solely on a local device. It may include content, account information, access logs, synchronisation records, object versions, administrative actions, backups, and provider-generated metadata. The relevant infrastructure may span countries and multiple subcontractors.

Cloud investigations present several challenges:

• jurisdiction and conflicting legal requirements;
• rapid deletion or short retention periods;
• multi-tenant systems;
• provider-specific terminology and interfaces;
• shared responsibility between customer and provider;
• encryption and customer-managed keys;
• uncertain location of data;
• changing systems and incomplete logs; and
• difficulty establishing that an export is complete and authentic.

Investigators should identify the provider, account, tenant, relevant identifiers, time range, data categories, retention policy, and legal process required. Provider responses should be preserved in their original form, together with certificates, explanatory statements, export documentation, and relevant system descriptions where available.

A cloud export may be a logical collection rather than a disk image. Its evidential value depends on how the provider generated it, what filters were applied, whether data was altered during export, and whether the provider can explain its systems. Multi-factor authentication records, token use, device identifiers, and synchronisation histories may help distinguish direct user activity from automated synchronisation or a compromised session.

9. Admissibility and Evidential Weight

Admissibility rules differ among legal systems, but courts commonly consider relevance, authenticity, reliability, legality, hearsay or documentary-evidence rules, privilege, and unfair prejudice. A technically genuine item may still be excluded if obtained unlawfully or if a statutory requirement was not met. Conversely, a procedural irregularity may affect weight rather than cause automatic exclusion, depending on the jurisdiction.

The proponent of digital evidence should be prepared to explain:

1. What the evidence is.
2. Where it came from.
3. Who collected it and under what authority.
4. How it was preserved and examined.
5. Why the method is reliable.
6. How the exhibit relates to the facts in issue.
7. What alternative explanations exist.

Authentication may be established through testimony from a person with knowledge, distinctive characteristics, system records, provider certification, forensic verification, or a combination of methods. A hash supports integrity of a particular digital object; it does not by itself authenticate authorship or prove the truth of statements within a document.

The best evidence principle is applied differently across legal systems and modern digital practice. A duplicate may be acceptable where it accurately reproduces the original, while a screenshot may be less informative than the underlying database or provider record. The investigator should preserve the most complete practicable source and explain any conversion or selection.

10. Expert Testimony

An expert witness assists the court by providing specialised knowledge that is relevant and reliable. Qualification may arise from education, training, certification, experience, publications, or professional practice. The expert’s duty is to assist the court objectively, not to act as an advocate for the retaining party.

A competent expert report should state:

• the question addressed;
• the materials reviewed;
• the methods and tools used;
• relevant validation or quality-control procedures;
• factual observations;
• interpretations and reasoning;
• assumptions and limitations;
• alternative explanations considered; and
• conclusions expressed with appropriate confidence.

The expert should distinguish observation from inference. “The log contains a successful authentication at 14:03 UTC” is an observation. “The defendant personally performed the action” is an attribution requiring additional evidence and assumptions. Experts should not conceal failed tests, contradictory artefacts, tool limitations, or uncertainty.

Tool names do not replace explanation. A court may need to know what a tool did, whether it altered the source, how its output was verified, and whether the examiner independently checked important results. Reproducibility is strengthened when another competent examiner could repeat the process using the recorded evidence and method.

11. Applied Case: The Meridian Payroll Incident

This is an illustrative fictional case.

Background

Meridian Services discovered that a payroll file had been downloaded from its cloud collaboration platform and later used in fraudulent bank-account changes. The organisation suspected an employee because the download appeared in an account associated with that employee.

Problem

The investigation had to determine whether the employee downloaded the file, whether the account had been compromised, what information was exposed, and whether evidence could be presented without examining unrelated personal material.

Analysis

The security team first documented the incident and issued a preservation instruction. Legal counsel obtained appropriate authority for the relevant cloud records and the company laptop. The laptop was photographed, isolated from the network using a documented procedure, and acquired with write protection. A working copy was created for examination, while the master image was stored with restricted access.

The cloud provider supplied authentication logs, download events, token information, and account changes. The identity provider recorded a successful login from an address associated with a foreign hosting service. The laptop contained no corresponding browser session, download artefact, or token at the relevant time. A mobile authenticator record showed an unexpected approval request, and the employee reported approving it after receiving a misleading technical-support call.

The investigation normalised all times to UTC and compared provider records with endpoint and firewall logs. The account’s password had been changed shortly before the download, and a new recovery address had been added. These facts supported account compromise more strongly than direct laptop use. The investigators did not search unrelated personal cloud folders, and the report clearly distinguished provider observations from conclusions.

Approach and outcome

The organisation reset credentials, revoked active tokens, enabled phishing-resistant multi-factor authentication, notified affected individuals, and preserved the relevant records. The evidence demonstrated that the employee’s account had been used, but it did not establish that the employee personally performed the download. The case therefore shifted from an employee-misconduct theory to an account-compromise investigation.

Learning points

1. Account attribution is not the same as human attribution.
2. Correlation across independent systems is more persuasive than reliance on a single log.
3. Time-zone normalisation is essential.
4. Scope controls protect privacy and improve analytical focus.
5. Exculpatory evidence must be preserved and reported.
6. A technically plausible theory must still be supported by lawful, documented collection.

12. Professional Practice, Governance, and Contemporary Developments

Organisations should maintain written procedures for evidence handling, approved tools, examiner competence, access control, retention, incident escalation, and quality assurance. Training should include legal boundaries, privacy, secure storage, report writing, and courtroom communication. Independent review is valuable for significant investigations.

Artificial intelligence and automated analytics can assist with file classification, anomaly detection, transcription, and prioritisation. They should not be treated as autonomous fact-finders. Investigators must validate outputs, preserve input data and model information where relevant, test error rates, guard against bias, and ensure that automated ranking does not cause relevant exculpatory material to be ignored. Generative systems may produce plausible but unsupported explanations; every material conclusion requires human verification.

Contemporary investigations increasingly involve end-to-end encrypted services, remote work, containerised infrastructure, cryptocurrencies, Internet-of-Things devices, and ephemeral messaging. These developments increase the value of provider preservation, endpoint telemetry, memory analysis, authentication records, and sound legal cooperation. They also increase privacy risks, making proportionality and minimisation more important rather than less important.

Best-Practice Checklist

Before closing an investigation, confirm that:

• legal authority and scope were identified and recorded;
• collection was necessary, proportionate, and technically justified;
• volatile evidence decisions were documented;
• original sources and working copies were distinguished;
• acquisition tools and settings were recorded;
• integrity checks were calculated and retained where appropriate;
• the chain of custody is complete;
• time zones and clock reliability were assessed;
• metadata and logs were interpreted in context;
• cloud-provider limitations were documented;
• exculpatory and privileged material was handled appropriately;
• conclusions are separated from observations;
• limitations and alternative explanations are disclosed; and
• the report can be understood and reproduced by an independent reviewer.

Chapter Summary

Cybercrime investigation depends on a combination of legal authority, technical competence, evidential discipline, and respect for privacy. Investigators must distinguish search, seizure, preservation, examination, and disclosure, and must act within the scope of valid authority. Reliable collection requires careful first response, documented acquisition, write protection where possible, integrity verification, secure storage, and a complete chain of custody.

Metadata, system artefacts, and logs can establish important events but require contextual interpretation. Timestamps, IP addresses, account identifiers, and file attributes rarely prove human identity on their own. Cloud evidence introduces provider dependence, jurisdictional issues, multi-tenancy, retention concerns, and the need to understand logical exports. Admissibility commonly depends on relevance, authenticity, legality, reliability, and procedural fairness. Expert witnesses must explain methods and limitations objectively and distinguish observations from inferences.

The central professional principle is that a persuasive digital investigation is not simply one that finds incriminating data. It is one that obtains relevant material lawfully, preserves it reliably, tests competing explanations, protects privacy, and communicates conclusions with justified confidence.

Key Terms

Digital evidence: Information of potential probative value stored or transmitted in digital form.

Volatile evidence: Data that may disappear when a device or system loses power or changes state.

Persistent evidence: Digital information retained on storage media or in a maintained system.

Search: Lawful or authorised access to information to locate evidence.

Seizure: Lawful taking of possession or control of an item or data.

Preservation: Measures preventing deletion or alteration while authority for access or disclosure is obtained.

Forensic image: A structured copy of digital storage or data created for examination.

Logical acquisition: Collection of selected files, records, or account data rather than all addressable media.

Write blocker: A hardware or software control intended to prevent modification of source media.

Cryptographic hash: A fixed-length digest used to compare digital data for integrity purposes.

Chain of custody: A chronological record of evidence possession, transfer, storage, and examination.

Metadata: Data describing characteristics or context of other data.

Log: A record generated by a system or application about events or activities.

Cloud evidence: Data held or processed by a remote service provider.

Authentication: A process of showing that evidence is what it is claimed to be.

Admissibility: The legal determination that evidence may be received by a court.

Evidential weight: The persuasive value assigned to admitted evidence.

Expert witness: A qualified person who assists the court through specialised knowledge.

Minimisation: Limiting collection, use, or disclosure of irrelevant or excessive information.

Due process: Legal procedures and fairness protections governing state or other coercive action.

Review Questions

Short Answer Questions

1. What is the difference between preservation and examination?
2. Why does a hash value not prove authorship of a file?
3. Identify three attributes of reliable digital evidence.
4. Why must timestamps be interpreted with time-zone information?
5. What information should a chain-of-custody record contain?

Long Answer Questions

1. Explain the legal and practical issues an investigator should consider before searching a seized smartphone.
2. Describe a sound forensic acquisition workflow from initial identification to analysis of a working copy.
3. Discuss the principal challenges of collecting and authenticating cloud evidence.
4. Explain how metadata and logs can support an investigation while still producing misleading or incomplete conclusions.
5. Describe the duties and limitations of a digital forensic expert witness.

Analytical / Application Questions

1. A company account downloads confidential files from an unfamiliar country, but the employee’s laptop shows no corresponding activity. Develop an evidence-collection and analysis plan that considers account compromise, time zones, cloud records, privacy, and attribution.
2. During a house search, investigators find an encrypted laptop that is powered on and displaying an open chat application. Analyse the factors that should guide the decision to conduct live acquisition, isolate the device, or shut it down.
3. A forensic report relies on a screenshot, a provider export, and a system log to identify the accused as the person who sent a threatening message. Evaluate what additional evidence and methodological explanations would be required to support authenticity and human attribution.

Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes preservation from examination?

A. Preservation prevents alteration while examination analyses collected data.

B. Preservation is the same as obtaining a conviction.

C. Examination is limited to physical devices and never includes cloud data.

D. Preservation automatically authorises investigators to access all stored content.

Correct Answer: A. Preservation prevents alteration while examination analyses collected data.

Question 2

What is the primary purpose of a cryptographic hash in forensic work?

A. To prove who authored a document.

B. To help demonstrate that digital data has remained unchanged.

C. To identify the physical person using an IP address.

D. To decrypt a seized device.

Correct Answer: B. To help demonstrate that digital data has remained unchanged.

Question 3

Which statement about an IP address is most accurate?

A. It always identifies the individual who performed an action.

B. It proves that a device owner intended the recorded activity.

C. It may identify a connection or subscriber but does not alone establish human attribution.

D. It is equivalent to a user’s password.

Correct Answer: C. It may identify a connection or subscriber but does not alone establish human attribution.

Question 4

Why should investigators record the time zone when reviewing logs?

A. Because time zones determine whether a hash is valid.

B. Because systems may record events using different clocks and time conventions.

C. Because time zones reveal the author of every file.

D. Because a time zone replaces the need for corroborating evidence.

Correct Answer: B. Because systems may record events using different clocks and time conventions.

Question 5

Which item is most directly associated with chain of custody?

A. A list of unrelated cybercrime statutes.

B. A chronological record of evidence transfers and handling.

C. A prediction of future criminal behaviour.

D. A description of an organisation’s marketing strategy.

Correct Answer: B. A chronological record of evidence transfers and handling.

Question 6

What does a write blocker primarily help prevent?

A. Modification of source storage media during acquisition.

B. Unauthorised access to a cloud provider’s legal department.

C. Creation of a chain-of-custody record.

D. All forms of malware infection on the Internet.

Correct Answer: A. Modification of source storage media during acquisition.

Question 7

Which statement about cloud evidence is correct?

A. A cloud export is always a complete physical image of the provider’s infrastructure.

B. Cloud evidence never raises jurisdictional issues.

C. The investigator should understand how the provider generated and filtered the export.

D. A preservation request automatically permits examination of all account content.

Correct Answer: C. The investigator should understand how the provider generated and filtered the export.

Question 8

Which is an observation rather than an attribution?

A. The accused personally sent the message.

B. The defendant intended to cause harm.

C. A successful authentication was recorded at 14:03 UTC.

D. The suspect knowingly bypassed security controls.

Correct Answer: C. A successful authentication was recorded at 14:03 UTC.

Question 9

What is a central duty of an expert witness?

A. To advocate for the party that retained the expert.

B. To assist the court objectively using reliable specialised knowledge.

C. To conceal limitations in the examination method.

D. To decide the accused’s legal guilt.

Correct Answer: B. To assist the court objectively using reliable specialised knowledge.

Question 10

Which practice best reflects data minimisation?

A. Copying every account connected to a device regardless of scope.

B. Searching only data categories and time ranges reasonably related to the authorised purpose.

C. Deleting potentially exculpatory files before analysis.

D. Publishing all collected personal information to improve transparency.

Correct Answer: B. Searching only data categories and time ranges reasonably related to the authorised purpose.