Technical expertise in cases of crimes, related with computers

<Object of examination in technical expertise:
• Computing and parts thereof,
• Magnetic media related information,
• Computer programs,
• Schemes of information files,
• Documents reflecting the operation of automated information systems, including primary (input into the computer) and output,
• Investigative documents:
Protocol inspection of the scene,
Testimony of witnesses,
Materials departmental investigation,
etc.
– Presentation of the list of issues is not complete. Hardware and software are changing very quickly, and to provide all questions impossible. For a correct formulation of questions and the use of technical terms it is imperative to consult with an expert before the appointment of expertise.

Sample questions to be solved by this examination:
Computer forensics
– What information is shown for examination contain system blocks and diskety- What information is available on the system unit and on magnetic media, its purpose and the ability to use-
– What programs are contained in the charges against the system unit and magnetic nositelyah- What is their purpose and the ability to use-
– Are there to file system blocks and magnetic media text files- If so, what is their content and the ability to use-
– Is there any destruction of information provided on magnetic nositelyah- Is it possible to vosstanovlenie- If so, what is its content, the possibility of use-
– What software contained on the magnetic presented nositelyah- What is their content, purpose, the possibility of use-
– Does the magnetic media submitted by specialized programs used to guess passwords, or other illegal penetration into computer networks- If so, what are their names, especially the work, the possibility of using to penetrate the particular computer networks- there any indication that the application specific program for illegal entry into the above network, and if so, are any
– What is the chronological sequence of actions necessary to run a particular program, or of committing certain operatsii-
– Is it possible, working in the computer network environment to produce software products any changes of program files, and, if possible, what, how, and what computer can be made similar Changes-
– Is it possible to gain access to financial and other confidential information available in this networks- How is this accessibility
– How is the unlawful entry into said local computer networks- What are the warning signs of this proniknovenii-
– If trespassing produced externally, what opportunities exist to identify the computer that was proniknovenie-
– If there are no signs of entry into the network of the user, specify which computers can produce similar operatsii-

Technical examination of computers and their accessories
– The computer model is presented in which issledovanie- What are the technical characteristics of system unit and peripheral devices- What are the technical characteristics of the computing networks-
– Where and when manufactured and assembled this computer and its komplektuyuschie- Have the computer assembly factory or kustarno-
– Is the internal structure of the computer and peripheral devices attached technical dokumentatsii- not included in the design of computer whether changes (eg, if any additional built-in devices: hard drives, to expand the memory, reading optical discs and so on., And other configuration changes) –
– Healthy whether the computer and its komplektuyuschie- What is their iznos- What causes malfunction of the computer and peripheral devices- not contain Does infirmity magnetic media information-
– Does not adapt the computer to work with specific users (left-handed, low vision, etc.). –
– What are the technical characteristics of other electronic means of reception, storage and delivery of information (pager, an electronic notebook, phone server) – these are OK materials- What causes neispravnosti-

Diagnostic issues resolved examination of data and software
– Which operating system is used in the master computer
– What is the content of information stored on the internal and external magnetic media, including what software products out there nahodyatsya- What is the purpose of software products- What is the algorithm of their operation, the mode of input and output information- What time passes since the introduction of data to output the results at work Current computer program data- base
– Are these software license (or unauthorized), copies of standard systems or original razrabotkami-
– Have there been any program of systematic product any adjustments (and if so, what) changing some operations (and, if so, what) –
– Is this the original TZ- Has at his work that all the provided funktsiy-
– Were to restrict access to information, passwords hidden files, applications, protection, etc.-What is the content hidden information- does not undertake any attempts to guess passwords, hack protective equipment and other unauthorized access via
– Is it possible recovery of the erased carrier file it possible to restore the defective magnetic media information- What is the content of the recovered carrier file
– What is the mechanism of information leakage from the local computer networks, distributed network, a global network of Internet
– Are there any shortcomings in the computer, the work of individual programmatic What causes these sboev- not caused by a malfunction of the computer virus influence (a) – Does the negative impact of the virus on the majority of programs or it is valid only for certain Programs Is it possible to restore full functioning of the program (text file), damaged virusom-
– What is the content of information stored: on the pager, electronic notebook and pr.- Does the book hidden information and what is its soderzhanie-
– When the last adjustment was made of the file or the installation of this software product-
– What is the level of training in the field of programming and working with computer technology person performing the action data with a computer and software obespecheniem-

Identity issues resolved computer – technical expertise
– Do the computer components (circuit boards, magnetic media, drives, and so on.) Single source proiskhozhdeniya-
– Is it not written the computer program to certain party, a
Solve complex in the production of computer – technical and avtorovedcheskoy examinations.

Indicative list of issues resolved in the study of media machine information
– What type of media specifications (for some types of computers can be used, the maximum allowable recording capacity) –
– Does the carrier mechanical povrezhdeniya-
– What marked the media format in which information is recorded in the nego-
– What information is recorded on this nositel-
– What information is actually placed on the carrier (recording sequence for tapes, disc sector tracks, cylinders etc.) –
– What information is available on the logical media (files, directories, logical drives) –
– Do the damage information (bad sectors, lost blocks and so on.) –
– Can the correction information on nositele-
– Is there a media computer virus, if so, what, what changes are made and whether it is possible to neutralize it without prejudice to the information-
– Are the changes on the media the result of virusa-
– Is it possible to copy the information from this carrier and is it possible to copy a physical medium in tselom-
– If damaged media, whether restoration information-
– What information has previously been recorded on this medium (marked as deleted files) and whether it vosstanovlenie-
– How much takes all the information on the support of its parts and how much free mesta-
– What time takes up this information with regard to the type EVM-
– Do I need to work with information on the support special hardware or software decryption and perekodirovki-
– Is the media specific programs that destroy information in the event of unauthorized access, lack of keys and passwords or using another computer on whether to counter possible installations and other means of protection, it is capable of bypassing and how obrazom-

Issues resolved in the study of software
– What is the purpose of the software-
– Could the software used for the commission of the prestupleniya-
– Are there enough of this software for the commission of the crime, if not enough, what software do I need Advanced-
– Who is the developer of the obespecheniya-
– How does this software is distributed, who is the owner of this copy if there is a license or permission to use this product- What is the serial number of the copies of the software-
– What are the input and output data it works, how and in what form these data are entered into a computer, are whether (and, if created, where) temporary files and statistics and their contents in any form is issued, where it is stored or where the output is transmitted information-
– Do the files generated by the software, information about the crime, if they contain, the kakuyu-
– Does the program with their work and the availability of entering passwords klyuchey- If required, the way in which they are stored and coded whether there is an opportunity to read the password file using the simplest redaktorov-
– Is it possible to bypass the password when you run through otladchik-
– Does the machine carrier source code in the language of the Programming
– When was the last time changes were made to the program (for example, the date and time of creation or modification of files) –
– Are there any changes in the program in comparison with the original version that was changed, what consequences these changes privodyat-
– Does the program hostile functions that involve the destruction, blocking, modification or copying of information, disruption of computers, computer systems or networks are How these functions are carried out, and what the consequences privodyat-
– Is it possible spontaneous distribution of this program, that is, Is this program virusom-
– Is it possible to copy the information or the implementation requires installyatsiya-
– Have there been changes to the program, aimed at overcoming zaschity-
– What are the quantitative (volume occupied by the required number of floppy disks, the number of files and so forth.) And qualitative (assignment of specific files, hardware requirements, and so forth.) The characteristics of Programs
– Compliance with the algorithm of the specific program requirements specified in the TOR or stated in the instruction ekspluatatsii-
– Are there any errors in the calculations with the help of the program (whether rounding occurs if the correct algorithm for calculating the specific data and so on.) –
– Is there a compatibility of hardware and software on the computer, if not, how does this affect the normal operation of Programs
– Please specify the type of computer, computer system is compatible with the software hardware of the computer.
– Is there a specific full compatibility with other software programs running on your computer, if not, how it affects the normal functioning of the system-

Indicative list of questions in the study database
– How organized Database-
– In what format information is recorded, and what database it can obrabatyvat-
– What kind of information written in this baze-
– Information in the database is written in the usual way or zakodirovana-
– When was the last updated information-
– Are there hidden in the base (marked for deletion) fields and their soderzhanie-
– Are there any damage or changes to the database records as compared with the standard backup or, if so, are any
– How many records in the data-
– Does this database record specific soderzhaniya-
– Is it possible to make changes to this database using simple software tools (eg text editors, etc.).

The post Technical expertise in cases of crimes, related with computers appeared first on Blue Systems International.