디지털 포렌식(Digital Forensic)의 원리와 소송에서의 증거평가 방식

Computers are used for not only doing business but also committing crime and thanks to the burgeoning science of digital forensics evidence, a law enforcement agencies now use computers to fight crime. Evidence refers to information or objects that may be admitted into court for judges and juries to consider when hearing a case. Digital evidence is an information stored or transmitted in binary form that may be relied on in court. It can be found on a computer hard drive, a mobile phone, a personal digital assistant (PDA), a CD, and a flash card in a digital camera among other places. The digital evidence is commonly associated with both transactions data and electronic crime such as child pornography or credit card fraud etc. However digital evidence is now used to prosecute all types of crimes not just electronic crime. For example suspects’ e-mail or mobile phone files might contain critical evidence regarding their intent and their whereabouts at the time of a crime and their relationship with other suspects. Evidence can come from varied sources — from genetic material or trace chemicals ​to dental history, fingerprints, or car accident debris. The evidence can serve many roles in an investigation such as to trace an illicit substance identify remains or reconstruct a crime. In an effort to fight electronic crime and to collect relevant digital evidence for all crimes, law enforcement agencies are incorporating the collection and analysis of digital evidence also known as computer forensics into their infrastructure. Law enforcement agencies are challenged by the need to train officers to collect digital evidence and keep up with rapidly evolving technologies such as computer operating systems. Computer forensic examiners should assess digital evidence thoroughly with respect to the scope of the case to determine the course of action to take. The digital evidence by its very nature is fragile and can be altered damaged or destroyed by improper handling or examination. An examination is best conducted on a copy of the original evidence. The original evidence should be acquired in a manner that protects and preserves the integrity of the evidence. The purpose of the examination process is to extract and analyze digital evidence. The extraction refers to the recovery of data from its media. Analysis refers to the interpretation of the recovered data and putting it in a logical and useful format. Actions and observations should be documented throughout the forensic processing of evidence. This will conclude with the preparation of a written report of the findings. In this paper, I discussed the classic digital forensic theory of preserving and interpreting data on a hard disk with a single computer in mind. In addition, I presented basic essential knowledge about digital forensics from the perspective of both lawyers and experts.