A law-enforcement investigation is a formal inquiry carried out by police or other authorities to test evidence, identify suspects, and determine whether a crime occurred. It is not a finding of guilt; it is a process for collecting and verifying facts through interviews, warrants, device analysis, records, and witness statements.
In cyber security, these investigations matter because digital evidence is often fragile, distributed across platforms, and mixed with other criminal activity. A malware case may overlap with fraud, extortion, or violence, but each line of inquiry must be handled separately and supported by its own evidence. For defenders, the term usually appears when incident response work becomes part of a broader criminal case, requiring careful preservation of logs, chain of custody, and precise attribution. Clear investigation boundaries help avoid confusion, protect rights, and keep suspicion from being treated as proof.