Digitalni dokazi in integriteta v računalniški forenziki

diplomsko delo visokošolskega strokovnega študija Informacijska varnost

Matjaž Smolej (Author), Blaž Markelj (Mentor)

Abstract

Preiskava kaznivih dejanj in predstavitev dokazov na sodišču sta ključnega pomena za ugotovitev dejanskega stanja oziroma dokazovanje resnice. V diplomskem delu smo na pregleden način predstavili definicijo digitalne forenzike, njena načela in metodologijo. Definirali smo razliko med zavarovanjem in preiskavo elektronske naprave kot tudi razlike med zavarovanjem živega in mrtvega sistema. Opisali smo zgoščevalne funkcije, njihov pomen in določene pomanjkljivosti. Integriteta podatkov in zagotavljanje, da se podatki niso spremenili, se lahko zagotovita z uporabo zgoščevalnih funkcij. Sodišče lahko uporabi dokaze, ki so bili pridobljeni na zakonit način, kar opredeljuje Zakon o kazenskem postopku. Vsi dokazi, ki niso pridobljeni na takšen način, ne morejo biti uporabljeni kot dokazi. V nadaljevanju smo predstavili programsko in strojno opremo in opredelili pomen uporabe omejevalnika zapisovanja. Diplomsko delo smo nadaljevali s predstavitvijo delovanja klasičnih trdih in SSD diskov, ki uporabljajo bliskovni pomnilnik. Opisali smo arhitekturo in funkcije, ki se uporabljajo za delovanje, kot tudi načine za reševanje podatkov v primeru okvare. V praktičnem delu naloge smo prikazali razlike pri obnovi podatkov iz klasičnega trdega in SSD diska. Z lastnimi testi smo prikazali problem zagotavljanja integritete na SSD diskih, ki uporabljajo lastne krmilnike z operacijskim sistemom in bliskovni pomnilnik.

Keywords

kazniva dejanja;preiskovanje;digitalni dokazi;digitalna forenzika;diplomske naloge;

Data

Language:	Slovenian
Year of publishing:	2017
Typology:	2.11 - Undergraduate Thesis
Organization:	UM FVV - Faculty of Criminal Justice
Publisher:	M. Smolej]
UDC:	343.985:004(043.2)
COBISS:	3380202
Views:	926
Downloads:	138
Average score:	0 (0 votes)
Metadata:

Other data

Secondary language:	English
Secondary title:	Digital evidence and integrity in computer forensic
Secondary abstract:	Investigating criminal offences and presenting the evidence in court is of key importance in determining the facts of the case or proving the truth. The bachelor thesis presents the definition of digital forensics, its principles and methodology in a clear way. It defines the difference between securing and examining an electronic device, and the difference between securing a live or dead system. It describes the compression functions, their importance and certain drawbacks. Data integrity and assurance that the data has not been modified can be ensured by using compression functions. The court may use evidence that has been acquired legally, as laid down in the Criminal Procedure Act. All evidence that has been acquired otherwise cannot be used as evidence. The thesis afterwards presents the software and hardware, and determines the importance of using a recording limiter. The bachelor thesis continues with a presentation of the operation of classic hard disk drives and SSDs that use flash memory. It describes the architecture and the functions it uses to operate, as well as the methods of recovering data in the event of failure. The empirical section of the thesis shows the differences in recovering data from a classic hard disk drive and an SSD. By running tests, the author has demonstrated the problem of ensuring integrity on SSDs, which use their own controllers with an operating system and flash memory.
Secondary keywords:	data integrity;compression functions;flash memory;
URN:	URN:SI:UM:
Type (COBISS):	Bachelor thesis/paper
Thesis comment:	Univ. v Mariboru, Fak. za varnostne vede, Fak. za elektrotehniko, računalništvo in informatiko
Pages:	52 str.
ID:	9630631