The technical expertise in computer crimes forensics
By Vladimir Golubev
Date: May 14, 2003
Various examinations are necessary for successful investigation of computer crimes. Purpose and carrying out of traditional examinations (criminalistics, examinations of substances and materials, economic, etc.) does not cause special difficulties. Computer-technical examination is a rather new kind of examinations and has some features.
Describing computer-technical expertise as the independent kind of judicial examination, experts of the Computer Crime Research Center define the following kinds:
- Technical expertise of computers and peripheral devices^;
- Technical expertise of the computer information protection equipment^;
- Examination of the data and the software used in computers^;
- Examination of the data and software used in a computer network.
In preparation for the examinations it is necessary to take into account the following features:
- Qualification of incident: infringement of a mode access to system resources, program failure, operator error or computer crime^;
- The reasons of trouble in access to computer system resources and the reason of failure in work^;
- Object of a criminal encroachment and a way of crime commission^;
- The circumstances promoting computer crime^; place, time and the person (or group of persons) committed crime^;
- The value and type of the caused damage.
The computer-technical expertise allows to receive and fix the concrete data on origin of exhibits and their attributes.
Thus examination creates necessary conditions for finding-out of circumstances of an incident and promotes successful investigation of a concrete computer crime.
Computer Crime Research Center
News Archive
^macro[showdigestcomments;^uri[];The technical expertise in computer crimes forensics]