Cybercrime Technical Evidence Package

Detects cybercrime investigation technical evidence including digital forensics, malware analysis, cryptocurrency tracing, dark web investigations, and covert online personas. Disclosure enables cybercriminals to develop countermeasures.

Type: keyword_proximity
Engine: universal
Confidence: medium
Confidence justification: Medium confidence: enforcement requires populated investigation fields or machine artefacts; case numbers are unpublished, so the reference is a documented label-anchored fallback.
Jurisdictions: global
Regulations: Criminal Code Act 1899 (Qld), Criminal Code Act 1995 (Cth)
Frameworks: QGISCF
Data categories: law-enforcement
Scope: wide
Risk rating: 8

Pattern

(?i)\b(cybercrime\s+investigation\s+(?:report|evidence|file)|digital\s+forensic\s+(?:analysis|examination|report)|network\s+intrusion\s+investigation|malware\s+(?:reverse\s+engineering|analysis\s+report)|cryptocurrency\s+(?:tracing|investigation)|dark\s+web\s+investigation|IP\s+attribution\s+(?:report|analysis)|covert\s+online\s+persona)\b

Corroborative evidence keywords

PROTECTED, Law-Enforcement, QPS Cybercrime Squad, ACSC, Australian Cyber Security Centre, digital forensic, malware sample, SHA-256, MD5 hash, IP address, cryptocurrency wallet, Bitcoin address, Tor hidden service, command and control, C2 server, investigation, enforcement, prosecution, arrest, evidence (+37 more)

Proximity: 300 characters

Should match

PROTECTED Law-Enforcement. QPS Cybercrime Squad — Digital Forensic Analysis Report. Case number: CY2025-0234. Network intrusion investigation. Malware reverse engineering: custom Cobalt Strike variant. IP attribution traced C2 server to Eastern Europe. SHA-256: a3f2b8c9d1e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0. — QPS cybercrime forensic analysis with malware and IP attribution (reaches 75)
RESTRICTED. Dark web investigation — Operation SHADOWNET. Covert online persona on dark web marketplace. Cryptocurrency tracing: Bitcoin through three mixing services. ACSC coordination for takedown. — Dark web investigation with cryptocurrency tracing (65 discovery only - prose without populated record fields)
Cybercrime technical evidence package. Digital forensic examination of 6 seized devices. Malware analysis: custom ransomware. Cryptocurrency investigation: 47 BTC traced. Dark web investigation confirms subject on two forums. — Multi-device forensic with ransomware and crypto evidence (65 discovery only - prose without populated record fields)
QPS Cybercrime Squad — digital forensic examination report Suspect: Avery Teston Date of birth: 04/02/1991 Case number: CY2026-0417 Malware sample recovered from the seized laptop; C2 server traced through a Tor hidden service. — Populated forensic report: suspect, DOB and case number plus malware / C2 evidence (reaches 85)

Should not match

The ACSC published its annual threat report noting a 23% increase in ransomware. The report recommended multi-factor authentication. — Published ACSC annual threat report
A cybersecurity conference discussed digital forensic techniques using anonymised case studies from published proceedings. — Conference presentation on cybercrime techniques
A university thesis examined malware reverse engineering using publicly available samples from VirusTotal. — Academic thesis on malware analysis
Policy guidance: this procedure explains how records about Digital Forensic are handled, who may access them and how long they are kept. It contains no records about any person or system. — Policy guidance naming the topic without any record (discovery only)
Digital forensic examination request Suspect: __________ Date of birth: __________ Case number: __________ — Blank form / template with unfilled fields (must stay below 75)
News: police said the network intrusion investigation into the council breach is continuing and no arrests have been made. — News or training text naming the topic (must stay below 75)

Known false positives

Published cybersecurity threat reports Mitigation: Negative keyword exclusion: 'annual threat report', 'published', 'advisory'. Require case identifiers.
Conference presentations and training Mitigation: Negative keyword exclusion: 'conference', 'presentation', 'training', 'anonymised'
Academic research on cybercrime Mitigation: Negative keyword exclusion: 'academic', 'university', 'thesis', 'VirusTotal', 'publicly available'
Non-law-enforcement IT security incidents Mitigation: Require law enforcement classification markers or agency references