RU2297664C1 - Automated workplace for performing criminalistic reviews of electronic information carriers - Google Patents

Abstract

FIELD: criminalistics and forensic examination.

SUBSTANCE: automated workplace consists of stand for researching electronic information carriers and personal computer. Stand featured in invention consists of controllable commutation device, ensuring possible mating of electronic information carrier and personal computer, and a source of controllable voltage. Controllable commutation device has m+n inputs/outputs and is represented by a set of m·n controlled rectifying cells, forming a commutation matrix of m×n dimensions, connecting 1÷m and (m+1)÷(m+n) inputs/outputs, while m=k+1, numbers k and n corresponding to maximal values of numbers of contacts of sockets of personal computer and electronic information carrier, respectively. Controllable rectifying cell is in turn represented by device, providing controllable capability of one-direction commutation with controllable transfer coefficient.

EFFECT: no limitations on types of electronic information carriers being connected, increased quality and speed of reviews of electronic information carriers, in other words, suggested automated workplace allows highly reliable fast access to information, stored in memory of electronic information carrier received for review, while quantitative and qualitative characteristics of electronic information carriers are not changed.

3 dwg

Description

The proposed automated location (AWS) relates to the field of forensics and forensic science, namely the use of electronic means to increase the efficiency and objectivity of conducting examinations and expert studies of electronic information carriers by automating a number of operations.

The proposed AWP allows with high reliability to quickly access information stored in the memory of the electronic information carrier (ENI) received for the forensic examination, while the quantitative and qualitative characteristics of the ENI do not change, which is crucial for ensuring the validity of the results of the forensic procedure.

One of the types of forensic examination is computer-technical examination (CTE). At this stage of development, KHPP is an independent type of forensic examination belonging to the class of engineering and technical examinations and carried out in order to: determine the status of an object as a computer tool, identify and study its trace in the crime under investigation, and also gain access to computer information on ENI with subsequent comprehensive study of it. These goals are represented by the generic tasks of the CHP [1].

The process of collecting evidence for crimes involving the use of computer tools includes, first of all, the detection, recording and removal of computer information. The tactics of investigative actions for the disclosure and investigation of crimes in the case under discussion are inextricably and directly dependent on the special tools and instruments used. These technical means should be designed for the search and preliminary investigation of ENI, which can subsequently acquire the status of material evidence. Instruments, apparatus, equipment, instruments, accessories used to collect and study evidence in the process of legal proceedings are commonly referred to as “forensic technology”.

The primary basis of the class of forensic technology under consideration is hardware and software, techniques and methods borrowed from such fields of science and technology as computer engineering and programming, radio engineering and electronics, computer networks and telecommunications, cryptography and information protection.

Gradually, the forensic technique is replenished with means, techniques and methods specially developed for the purpose of investigation and disclosure of crimes in the field of computer information.

To date, the following technical means are the typical technical and forensic equipment for collecting computer information [2]:

- a personal portable computer (IBM-compatible), with sufficient speed and RAM, with the possibility of preliminary full physical copying of the studied storage media (including hard drives) to a working hard drive of the appropriate capacity (often in a removable version);

- Windows 98 (2000) operating system installed on the specified PC with a set of system and application utilities (for example, Norton System Work); file managers (including with support for MS DOS-sessions), advanced application software (MS Office, graphic packages (PhotoShop, Corel-Draw), etc .;

- a set of empty 3.5 "floppy disks;

- CD-RW device for recording on compact discs;

- a set of empty CD-R;

- necessary interface cables (including null modem cable);

- a set of floppy disks (bootable and with service utilities) for determining the configuration of the investigated personal computer, its characteristics;

- A set of floppy disks with virus diagnostic programs;

- packaging material: rigid boxes for packaging seized system units and data carriers; antistatic bags for data carriers, plastic bags and canvas bags; paper for sealing connectors, adhesive, adhesive tape;

- auxiliary tools - an electronic tester, screwdrivers, pliers, etc. (for example, to disconnect connectors, open the covers of system units, remove hard drives).

The stated positions relate to only one type of computer facilities - IBM-compatible computers and typical ENI to them. At the same time, the variety of hardware and software of modern information technologies requires the development of similar approaches to other possible research objects (computer networks, telecommunications and communications, personal use tools (electronic organizers, pagers), etc.) that are of interest to the investigation.

Means of researching information stored in electronic form should provide [3]:

- the technical ability to access the information contained in the object of study (computer hard drives, flexible magnetic disks, magneto-optical disks, tape drives, optical disks, flash memory and other means of information storage);

- fixing information without destroying or changing the object of study (for example, on hard disks of laboratory computers, recordable optical discs);

- Converting information into a form accessible to an expert (software for searching and visualizing information).

These tasks are solved jointly by hardware and software research support.

Thus, we can conclude that the methodology for solving any problem during computer-technical examination should be refined when a new generation of hardware or new software versions appears [4, 5].

Thanks to the presence of highly qualified specialists, a number of leading expert organizations are developing technologies for conducting practical work on conducting forensic examinations of ENI. For this, a whole range of specific non-standard work is carried out, the corresponding tools are developed and mastered.

The result of the corresponding work is AWP (software or hardware-software systems) for all specific types of work.

Methodological developments and automation tools, accumulating the knowledge and experience of unique, highly qualified specialists, make it possible to increase the level of solving CHP issues by small local forces by assigning these tasks to small groups or individual full-time experts.

One such AWP is the PROPLAN system.

The PROPLAN workstation for computer-technical expertise is a specialized software and hardware complex that automates the activities of the expert and his workplace at CHP.

The technical part of the complex is:

- a stand for the study of information media,

- A personal computer for processing research data and preparing an expert opinion.

The software part of the complex consists of a set of general and special software (OMO and SMO).

As a QS, the "Professional system for solving Search problems and Logical ANALYSIS of machine data carriers" ("PROPLAN") is used.

AWP "PROPLAN" is selected as a prototype.

The main disadvantage of the prototype is the inability to connect ENI of new types that appeared after its creation, and the inability to modernize it to eliminate this drawback due to the limited number of system interrupt codes corresponding to the maximum number of connected external devices.

An object of the invention is to remove restrictions on the types of connected ENI.

Since modern ENIs differ in the used interface standards and command systems, a large set of such devices is required to create an automated workstation that allows examining any ENI on the basis of standard access and pairing devices; in addition, the use of standard tools does not guarantee that the quantitative and qualitative characteristics of ENI will not change, which is crucial to ensure the validity of the results of the forensic procedure.

In this way:

- preparation of the workstation for the examination of a specific ENI may require a change in its configuration (which can lead to a significant waste of time);

- the formation of a complete set of standard access and pairing devices is associated with significant material costs;

- the need to take measures to modernize standard access and interface devices to exclude the possibility of modifying the quantitative and qualitative characteristics of ENI requires appropriate expert qualifications.

Therefore, the second objective of the invention is to improve the quality and efficiency of ENI examinations.

The problem is solved in that the workstation for conducting forensic examinations of ENI consists of:

- a universal stand for the study of ENI;

- PC 1 for the preparation and storage of guidelines, processing of research data and the preparation of an expert opinion (see figure 1).

A universal test bench for ENI research is a combination of a controlled switching device (UKU) 2, which provides the possibility of pairing ENI and PC 1 via information and control buses (the term “pairing” means providing an electrical connection and matching signal levels), and a regulated voltage source (IRN) 3, allowing to provide power to UCU and ENI (through UCU), (see figure 1).

UKU 2 has m + n inputs / outputs (BB) and is a set of m · n controlled gates (HC) 4 forming a switching matrix of dimension m × n connecting 1 ÷ m and (m + 1) ÷ (m + n ) BB (see FIG. 2) in such a way that every i-th BB (i∈ {1, m}) is connected to the j-th BB (j∈ {m + 1, m + n}) via HC 4. ij. Moreover, m = k + 1, the numbers k and n correspond to the maximum values of the numbers of contacts of the PC and ENI connectors, respectively.

UV 4 is designed to provide the possibility of pairing ENI and PC 1 on the information buses and control buses, as well as providing the possibility of supplying electrical power from the IRN to ENI.

HC 4 consists of two controlled amplifiers (CC) 5 and 8, as well as two uncontrolled gates (CCF) 6 and 7, with the outputs of CC 5 and 8 connected to the inputs of CCF 6 and 7, respectively, and the outputs of CCF 6 and 7 connected to the inputs WC 8 and 5, respectively. The connection points of the inputs of the UE and the outputs of the NUV serve as inputs / outputs of the HC 4 (see figure 3).

IRN 3 is a power supply unit that provides the ability to generate voltage, the value of which is not less than necessary for power ENI.

The principle of the workstation is as follows. Each pin of the PC connector 1 is connected to the i-th BB (i∈ {1, k}) of UKU 2. Each pin of the ENI connector is connected to the j-th BB (j∈ {m + 1, m + n}) of UKU 2. Output IRN 3 is connected to the m-th explosive device of UKU 2. All UU 8 of the m-th channel of UKU 2, channels connected to the terminals of the PC 1 connector, which are outputs, and channels connected to the contacts of the ENI connector, which are inputs, are set to zero gain (at the output of UU 8 a constant zero potential). All UU 5 m-th channel of UKU 2, channels connected to the terminals of the PC connector 1, which are inputs, and channels connected to the contacts of the connector ENI, which are outputs, are set to the specified gain level (ensuring matching of the input and output signal levels of the PC and ENI )

AWP can be used in two modes:

1) research mode;

2) the regime of forensic examination of ENI.

In a research mode, the implementation of all compounds and the establishment of the necessary voltage levels is carried out by a highly qualified specialist based on a study of the technical characteristics and characteristics of ENI. The results are recorded in the form of guidelines placed in the memory of PC 1.

In the forensic examination mode of the ENI, after all the connections have been made and the necessary voltage levels have been established (in accordance with the methodological instructions), information is read from the ENI memory and an ENI image is formed in the PC memory 1 (operational or long-term, for example, on a hard magnetic disk).

After forming the image, ENI UKU 2 is disconnected and ENI is disconnected from UKU 2.

Further comprehensive study of the information is carried out when working with the image ENI.

The proposed workstation can be used for all types of ENI, however, due to the fact that the problem of access to information is most difficult to solve for ENI, which are not directly intended for use as external PC devices, the practical solution of such devices is of particular importance (for example, electronic organizers and notebooks, pocket translators, cruise controllers, GPS receivers, etc.).

Bibliography

1 Zubakha B.C., Usov A.I., Saenko G.V., Volkov G.A., Bely S.L., Semikalenova A.I. General provisions on the designation and production of computer-technical expertise: Methodological recommendations. - M .: GU EKTS Ministry of Internal Affairs of Russia, 2000. - 65 p., 6 ill., Bibliographer., Adj.

2 Sheludchenko V.I. Technical and forensic tools and methods for collecting computer information // Materials of the All-Russian Interdepartmental Seminar. - Belgorod: Ministry of Internal Affairs of the Russian Federation, 2002. - S.205-207.

3 Kopytin A.V., Marshalko B.G., Fedotov E.T. Forensic examination of a personal computer // Materials of the All-Russian Interdepartmental Seminar. - Kazan: Ministry of Internal Affairs of the Republic of Tatarstan, 2004. - P.115

4 Aikov D., Seiger K., Fopstorh U. Computer crimes. Computer Crime Guide. Per. from English V.I. Voropaev and G.G. Trekhalin. - M .: Mir, 1999.

5 Semenov N.V., Motuz O.V. Forensic-cybernetic examination - a tool to combat crime of the XXI century // Information Protection, Confident, 1999, 1-2.

Claims (1)

An automated workstation for conducting forensic examinations of electronic storage media, consisting of a stand for researching electronic storage media and a personal computer 1 for processing research data and preparing an expert opinion, characterized in that the stand for researching electronic storage media is universal, consisting of a controlled switching device 2 providing the possibility of interfacing an electronic information carrier and a personal computer (1) on information buses and buses board, and a regulated voltage source (3), while the controlled communication device (2) has m + n inputs / outputs and is a set of m · n controlled gates (4) that form a switching matrix of dimension m · n connecting 1 ÷ m and (m + 1) ÷ (m + n) inputs / outputs in such a way that each i-th input / output (i∈ {1, m}) is connected to the j-th input / output (j∈ {m + 1, m + n}) by means of a controlled valve (4.ij), with m = k + 1, the numbers k and n correspond to the maximum values of the numbers of contacts of the PC connectors (1) and the electronic information carrier, respectively; in turn, the controlled valve (4) consists of two controlled amplifiers (УУ) (5, 8), as well as two uncontrolled valves (НУВ) (6, 7), and the outputs of controlled amplifiers (5, 8) are connected to the inputs of uncontrolled gates (6, 7), respectively, the outputs of uncontrolled gates (6, 7) are connected to the inputs of controlled amplifiers (8, 5), respectively, and the connection points of the inputs of controlled amplifiers and outputs of uncontrolled gates serve as inputs / outputs of controlled gates (4); the output of the regulated voltage source is connected to the mth input of the controlled switching device (2), 1 ÷ k the inputs / outputs of the controlled switching device (2) are connected to the contacts of the PC connector (1), (m + 1) ÷ (m + n) inputs / outputs of a controlled switching device (2) are connected to the contacts of the connector of the electronic information carrier.

Images