Postopki digitalne forenzike in zagotavljanje integritete podatkov : diplomsko delo visokošolskega strokovnega študija Varnost in policijsko delo

Diplomsko delo opisuje temeljne postopke digitalne forenzike, vključno z relevantnimi pravnimi predpisi, strokovnimi principi, standardi in metodologijo digitalne forenzike. Pri tem sta opredeljeni programska in strojna oprema za izvajanje digitalno-forenzičnih opravil ter oba glavna procesna postopka postopek zavarovanja podatkov in postopek preiskave elektronske naprave. Prav tako so predstavljeni načini zagotavljanja integritete podatkov, ki temeljijo predvsem na uporabi ustrezne programske opreme za izračun kontrolne zgoščene vrednosti. Zadnja je rezultat uporabe različnih zgoščevalnih funkcij, ki za to opravilo niso enako primerne. V nekaterih so bile namreč odkrite pomanjkljivosti, ki vplivajo na nivo zagotovljene integritete podatkov. Pri sodnih postopkih je namreč bistveno, da se ugotovi resnica oziroma dejansko stanje, kar se ugotavlja na osnovi veljavnih dokazov. Pri elektronskih napravah so to digitalni podatki, ki jih je treba ustrezno zavarovati in preiskati, pri tem pa tudi zagotavljati njihovo integriteto. Zadnje je eno od pomembnejših zagotovil, da so tako pridobljeni dokazi na sodiščih sprejeti kot veljavni. Postopki, ki so izvedeni nedosledno, nestrokovno in v nasprotju z zakonskimi določili, namreč posledično privedejo do neveljavnih digitalnih dokazov, s katerimi običajno ni možno dokazovati dejanskega stanja. Opisana tematika je ponazorjena na praktičnem primeru izvedbe celotnega postopka preiskave elektronske naprave, ki vključuje tudi predhodni postopek zavarovanja podatkov, ter izdelavi pripadajoče dokumentacije zapisnika o zavarovanju podatkov elektronske naprave in zapisnika o preiskavi elektronske naprave.The present thesis describes the fundamental procedures of digital forensics, including the relevant legal regulations, professional principles, standards and methodology of digital forensics. It defines the software and hardware for performing digital forensic tasks and the two main procedural processes - the process of data acquisition and the process of electronic device investigation. It also presents the methods of data integrity assurance, primarily based on the use of appropriate software for the calculation of concentrated control values. Control values are the result of using different hash functions, which are however not equally suited for this task. Some functions have shown deficiencies that affect the level of guaranteed data integrity. In court proceedings, it is essential to establish the truth and actual facts, which are determined on the basis of the evidence presented. In the case of electronic devices, the evidence is digital data, which have to be properly acquired and investigated, while ensuring their integrity. This is one of the most important assurances that the evidence obtained in this way will be admissible in court. Procedures that are carried out inconsistently, unprofessionally and in violation with the law consequently lead to inadmissible digital evidence, based on which it is usually impossible to prove the actual facts. The described topic is presented with a practical example of the whole process of electronic device investigation, including the pre-litigation process of data acquisition, and the creation of the associated documentation – the report of electronic device data acquisition and the report of electronic device investigation