DIGITAL FORENSICS AS A COMPONENT OF FORENSIC TECHNOLOGY: CURRENT STATE AND PROSPECTS FOR DEVELOPMENT

Abstract

The article is devoted to consideration of the issue of digital forensics as a component of forensic technology. Based on the analysis of scientific literature and existing forensic studies, the author's definition of digital forensics is formulated, under which it is proposed to understand the section of forensic techniques that studies the peculiarities of the formation of digital traces and trace patterns in the virtual environment, as well as the system of technical means and applied algorithms for their detection, extraction, research and submission for direct examination by the court during the trial of criminal proceedings. At the same time, several directions of digital forensics are singled out as a component of forensic techniques: first, collection and recording of digital information from various media. In this context, it is noted that the collection of information is carried out from: first, stationary devices: computer equipment (without disconnection from the local network – directly at the place where the device was located, since in this case access to certain databases, storages, which, in the case of transferring the device, they are lost, after which the computer equipment itself is directly removed as an information carrier, which is subsequently subject to thorough research and certain examinations); secondly, from portable media: flash drives, telephone devices, SD cards, hard drives, etc.; secondly, the study of digital information. In the specified direction, the following are highlighted: a) research of digital information available on computer devices; b) research of digital information contained on digital information carriers (at the same time, it is the digital information that is researched, and not directly the carrier and its technical characteristics, etc.); c) research of digital information contained in cloud storages (intangible media). In this aspect, as a separate subspecies, it is proposed to define social networks, which are a separate source of storage, acquisition and distribution of digital information, arguing this position by the fact that during recent years, during which Ukraine is suffering due to a full-scale Russian invasion, “atypical” networks have become more and more widespread for Ukraine, crimes such as, for example, treason. It was established that digital information obtained as a result of the investigation of criminal activity can be of different nature: first, information about a person (personal information about a person who committed an illegal act, who became a victim of a crime, and/or was a witness to it or contributed to it his actions); secondly, information that indicates the commission of an illegal act. In the context of consideration of the declared category, the following are distinguished: a) information that indicates the method of committing an illegal act; b) information about the circumstances to be established during the investigation of criminal proceedings; c) information about criminal offenses that are planned in the future. It is proposed to introduce legislative changes, in particular, first of all to Part 2 of Art. 84 of the Criminal Procedure Code of Ukraine and set it out in the following version: “2. Procedural sources of evidence are testimony, material and digital (electronic) evidence, documents, experts' conclusions”.