LONDON — Bank robbers wear masks and escape in vans with stolen license plates. Kidnappers compose ransom letters from newsprint to elude handwriting experts. Burglars target houses with the upstairs window ajar.

Cybercriminals do much the same.

They hide behind software that obscures their identity and leads investigators to look in countries far from their actual hide-outs. They kidnap data and hold it hostage. And they target the most vulnerable companies and people whose information is poorly protected.

Cybercrimes, like the global ransomware attack that began Friday and has affected hundreds of thousands of computers in more than 150 countries, are in a way an updated version of ancient criminal methods.

And in the global search for the criminals that continued Sunday, investigators are following much the same process that detectives in the physical world have used for decades: secure the crime scene, collect forensic evidence and try to trace the clues back to the perpetrator.