Features of computer technique facilities examination

Abstract

The features of examination of computer technique facilities have been analyzed; and the general procedure of its holding has been formulated. Special attention has been paid to the relevance of the studied issue, relevant statistics on Internet users and some types of committed cybercrimes have been provided. The author has determined the main means of computer facilities, which law enforcement agencies face. The main types of examination of computer technique facilities based on the type of studied means (standard, mobile, consumer, etc.) have been provided. On the basis of the analysis of scientific, methodical, educational literature and regulatory sources the author has highlighted a number of problematic issues that exist in the studied area. The author has revealed the features of law enforcement agencies’ activities at the preparatory stages (tools formation, work with catalogs of forensic software, hardware means, and directly during the examination (general algorithm for data collection, methods of securing collected data, peculiarities of working with flash drives, methods of sterilization of carriers in operating systems Linux and Windows, the procedure of examination of the collected data, etc.).

The attention has been paid on the importance of collecting and documenting volatile data (RAM, network processes, terminal clients’ work). Two main ways of collecting non-volatile data (creating an image of corresponding carrier and its duplicate) have been revealed; their advantages and disadvantages have been analyzed. The peculiarities of examining mobile computer facilities, software and physical way of removing the backup of mobile devices have been outlined; some examples have been provided.

It has been concluded that properly conducted examination of computer technique facilities from technical and legal points of view is the basis for the successful detection, suppression and investigation of cybercrimes.