RU2755263C1 - Method, automated workstation and stencil for conducting computer forensic criminalistic examination of plastic cards - Google Patents

Abstract

FIELD: testing.

SUBSTANCE: invention relates to the field of criminalistics and forensic examination. The automated workstation (AWS) for conducting computer forensic criminalistic examinations of plastic cards consists of a PC, a stand for inspecting electronic data carriers (EDCs), a contact and non-contact readers, a scanner and a special stencil. The method for conducting computer forensic criminalistic examinations of plastic cards involves forming and processing a large binary object by the AWS hardware using software to obtain answers to questions posed to the expert. The stencil for positioning plastic cards during scanning is characterised by the presence of cells for placement of plastic cards, each cell has extensions for the convenience of extracting the cards.

EFFECT: increase in the efficiency of conducting expert examinations and investigations of information carriers.

2 cl, 3 dwg

Description

The proposed method and devices relate to the field of forensic science and forensic examination, namely, to the use of computer technologies to increase the efficiency and economic efficiency of examinations and expert studies of information carriers by automating a number of operations.

The proposed method of computer forensic forensic examinations allows you to quickly perform research on a set of plastic cards presented for examination as material evidence in order to establish signs of forgery.

The proposed automated workstation (AWS) allows:

- with high reliability, promptly create a large binary object as an information copy of electronic storage media (ENI), which are plastic cards, while the quantitative and qualitative characteristics of ENI do not change, which is crucial for ensuring the legal force of the results of the forensic examination procedure;

- handle a BLOB identifying plastic cards;

- to form a final expert opinion.

The proposed stencil allows you to speed up the process of compiling a description of the appearance of the examined plastic cards.

One of the types of forensic science is computer forensics (CE). At this stage of development, CE is an independent type of forensic examination, belonging to the class of engineering and technical examinations and carried out in order to: determine the status of an object as a computer tool, identify and study its trace pattern in an investigated crime, as well as gain access to computer information on information carriers followed by a comprehensive study. These goals are presented as generic tasks of CE [1]. At the same time, ENI acts as information carriers for this type of expertise.

The process of collecting evidence on crimes involving the use of computer tools includes, first of all, the detection, fixation and seizure of computer information. The tactics of investigative actions for the disclosure and investigation of crimes in the case under discussion is inextricably and directly dependent on the special means and tools used. These technical means should be designed for the search and preliminary investigation of ENI, which can subsequently acquire the status of material evidence. Devices, apparatus, equipment, tools, accessories used for collecting and researching evidence in the course of legal proceedings are commonly referred to as “forensic techniques”.

The primary basis of the class of forensic technology under consideration is hardware and software, techniques and methods borrowed from such areas of science and technology as: computer technology and programming, radio engineering and electronics, computer networks and telecommunications, cryptography and information security.

Gradually, forensic technology is being replenished with means, techniques and methods specially developed for the purpose of research and disclosure of crimes in the field of computer information.

At the moment, the following means are typical technical and forensic equipment for collecting computer information [2]:

- a personal computer (PC), with sufficient speed and volume of RAM, capable of preliminary complete physical copying of the studied data carriers (including hard disks) to a working hard drive of appropriate capacity (often in a removable version);

- the operating system of the Windows family installed on the specified PC with a set of system and application utilities (for example, Norton System Work);

- file managers (including those with support for MS DOS sessions), advanced application software (MS Office, graphics packages (PhotoShop, CorelDraw), etc.);

- a set of blank CDs and / or CD-Rs;

- CD-RW device for writing to CDs;

- required interface cables (including null-modem cable);

- a set of CDs and floppy disks (bootable and with service utilities) to determine the configuration of the investigated personal computer, its characteristics;

- a set of CDs and floppy disks with virus diagnostics programs;

- packing material: rigid boxes for packing removed system units and data carriers; anti-static bags for storage media, plastic bags and canvas bags; paper for sealing connectors, glue, adhesive tape;

- auxiliary tools - an electronic tester, screwdrivers, pliers, etc. (for example, for disconnecting connectors, opening the covers of system units, removing hard drives).

Research tools for information stored in electronic form should provide [3]:

- the technical ability to access the information contained in the research object (hard disk drives, magnetic disks and tapes, magneto-optical disks, streamer cassettes, optical disks, flash memory and other information storage media);

- fixing information without destroying or changing the object of research (for example, on hard disks of laboratory computers, recordable optical disks);

- transformation of information into a form that can be perceived by an expert (software for searching and visualizing information).

These tasks are solved jointly by technical and software tools for research support.

Thus, we can conclude that the methodology for solving any problem in computer forensics should be refined when a new generation of hardware or new versions of software appears [4, 5].

Thanks to the presence of highly qualified specialists in a number of leading expert organizations, technologies for carrying out practical work on conducting forensic examinations by ENI are being developed. For this, a whole range of specific atypical works is carried out, the appropriate tools are developed and mastered.

The result of the corresponding work is AWP (software or hardware-software systems) for all specific types of work.

Methodological best practices and automation tools, accumulating the knowledge and experience of unique high-class specialists, allow us to increase the level of solving CE issues with small forces on the ground, by assigning these tasks to small groups or individual full-time experts.

One of these AWPs is the PROPLAN system.

The PROPLAN automated workstation for computer examination is a specialized software and hardware complex that automates the activities of an expert and his workstation at FE.

The technical part of the complex is:

- stand for research of information carriers,

- personal electronic computer (PC) for processing research data and preparing an expert opinion.

The software part of the complex consists of a set of general and special software (OMO and CMO).

The “Professional System for Solving Search Problems and Logical Analysis of Machine Information Media” (“PROPLAN”) is used as a CMO.

The main disadvantage of the specified AWP is the impossibility of connecting new types of ENI that appeared after its creation and the impossibility of its modernization to eliminate this drawback due to the limited number of system interrupt codes corresponding to the maximum number of connected external devices.

The indicated drawback was eliminated in the AWS for conducting forensic examinations of the ENI [6].

Workstation for conducting forensic examinations ENI consists of a stand for research ENI and a PC for processing research data and preparing an expert opinion. The test bench for ENI consists of a controlled switching device that provides the ability to interface an electronic data carrier and a PC via information buses and control buses, and an adjustable voltage source.

The method of examination of cards with a magnetic stripe implemented with the help of this AWP is as follows:

- read data from a magnetic stripe card;

- form in the memory of the AWP for conducting forensic examinations of electronic data carriers of a large binary object as an information copy of an ENI, in the role of which is a card with a magnetic stripe;

- carry out processing of the BLOB by hardware AWP using special software to get answers to the questions posed to the expert;

- form a final expert opinion.

The main disadvantage of this AWS is the focus on the study of only magnetic stripe cards, while modern plastic cards additionally have contact and contactless exchange interfaces with payment terminals, as well as focus on the examination of single cards.

This AWP and the described method are selected as prototypes.

The purpose of the invention is to create the possibility of conducting an examination of a set of plastic cards by using hardware and software AWP, which will reduce resource consumption and increase the efficiency of computer forensic examination.

The essence of the invention

1. AWS for computer forensic examinations of plastic cards, consisting of a stand for the study of ENI and a PC for processing research data and preparing an expert opinion, is distinguished by the fact that it additionally contains: a device for contact reading information from a plastic card, a device for contactless reading of information from a plastic cards, scanner, stencil.

2. A method of conducting computer forensic forensic examinations of plastic cards, containing:

- reading data from the magnetic stripe of plastic cards;

- formation in the memory of the AWP for carrying out forensic examinations of electronic data carriers of a large binary object as an information copy of plastic cards;

- carrying out processing of a blob by hardware AWP using special software to get answers to questions posed to an expert;

- formation of the final expert opinion, characterized in that it additionally contains:

- scanning the appearance of the examined plastic cards using a stencil;

- contact reading of data from plastic card chips;

- contactless data reading from plastic card chips.

3. A stencil for positioning plastic cards during scanning, characterized by the presence of slots for placing plastic cards with dimensions corresponding to the International Standard ISO-7810, each slot has extensions for easy card removal.

This goal is achieved by the fact that the AWS for conducting computer forensic forensic examinations of plastic cards consists of:

- PC 1 for the preparation and storage of guidelines, control of external devices, processing of research data and preparation of an expert opinion (see Fig. 1);

- Stand for research ENI 2;

- Contact reader 3 information from a plastic card;

- Contactless reader 4 information from a plastic card;

- Scanner 5;

- Stencil 6.

PC 1 is a device that provides the ability to input / output, storage and processing of data through the use of general and special software.

The ENI 2 research stand is a device that allows you to read the information contained on the magnetic stripe of a plastic card.

Contact reader 3 is a device that allows you to read information contained on a plastic card chip.

The contactless reader 4 is a device that allows you to read the information contained on the chip of a plastic card using NFC technology.

Scanner 5 is an input device that allows you to form a digital image of plastic cards.

Stencil 6 is a device placed in the working area of the scanner, which allows you to position the scanned plastic cards.

The inputs of the ENI Research Stand 2, Contact Reader 3, Proximity Reader 4, Scanner 5 are the AWP inputs for conducting computer forensic examinations of plastic cards, the information outputs of the ENI Research Stand 2, Contact Reader 3, Proximity Reader 4, Scanner 5 are connected to the information the input of the PC 1, the control output of which is connected in parallel to the control inputs of the Stand for research ENI 2, Contact reader 3, Proximity reader 4, Scanner 5, Stencil 6 is located in the working area of Scanner 5.

The principle of operation of the AWP for conducting computer forensic forensic examinations of plastic cards is as follows:

- the examined plastic cards are divided into groups of eight;

- the first group of eight plastic cards is placed in eight cells of Stencil 6 face down;

- using the controls of the PC 1, the operator generates a command that comes from the control output of the PC 1 to the control input of the Scanner 6 and initiates the scanning process, after which the digital image of the working field comes from the information output of the Scanner 6 into the PC 1, in which the images are extracted each card according to the coordinates of the cells of the Stencil 6 and for each card in the memory of the PC 1 an information copy is formed in the form of a large binary object;

- each card of the first group is removed from the cell of Stencil 6, turned over and placed in the same cell of the Stencil 6 with the back side down;

- using the controls of the PC 1, the operator generates a command that comes from the control output of the PC 1 to the control input of the Scanner 6 and initiates the scanning process, after which the digital image of the working field comes from the information output of the Scanner 6 into the PC 1, in which the images are extracted each map by the coordinates of the cells of Stencil 6 and added to the blob containing the description of the corresponding map;

- the above operations are repeated for all groups of the examined plastic cards;

- using the controls of the PC 1, the operator generates a command that comes from the control output of the PC 1 to the control input of the Stand for research ENI 2 and initiates the process of reading information from the magnetic stripe of the first examined plastic card, after which the read data is received from the information output of the Stand for studies ENI 2 in PC 1, in which they are added to the blob containing the description of the first map;

- repeat the above operation for all examined plastic cards;

- using the controls of the PC 1, the operator generates a command that comes from the control output of the PC 1 to the control input of the Contact reader 3 and initiates the process of reading information from the chip of the first examined plastic card, after which the read data is received from the information output of the Contact reader 3 into the PC 1, which is added to the blob containing the description of the first map;

- repeat the above operation for all examined plastic cards;

- using the controls of the PC 1, the operator generates a command that comes from the control output of the PC 1 to the control input of the Contactless reader 4 and initiates the process of contactless reading of information from the chip of the first examined plastic card, after the completion of which the read data comes from the information output of the Contactless reader 4 to PC 1, which is added to the blob containing the description of the first map;

- repeat the above operation for all examined plastic cards;

- Process each BLOB to get answers to the questions posed to the expert;

- form a final expert opinion.

In most cases, the correspondence of the data present in the external design, stored on the magnetic stripe and in the memory of the plastic card chip, is examined.

The appearance of a prototype AWP for carrying out computer forensic forensic examinations of plastic cards is shown in Fig. 3. MSR-206U, Omnikey 3121 and Omnikey 5422 are used as readers of information from the magnetic stripe and the chip.

Sources of information

1. Zubakha B.C., Usov A.I., Saenko G.V., Volkov G.A., Bely S.L., Semikalenova A.I. General provisions for the appointment and production of computer-technical expertise: Methodical recommendations. - M .: GU EKTs Ministry of Internal Affairs of Russia, 2000. - 65 p., 6 ill., Bibliographer., App.

2. Sheludchenko V.I. Technical and forensic means and methods of collecting computer information // Materials of the All-Russian interdepartmental seminar. - Belgorod: Ministry of Internal Affairs of the Russian Federation, 2002. - P.205-207.

3. Kopytin A.V., Marshalko B.G., Fedotov E.T. Forensic examination of a personal computer // Materials of the All-Russian Interdepartmental Seminar. - Kazan: Ministry of Internal Affairs of the Republic of Tatarstan, 2004 .-- P. 115.

4. Haykov D., Seiger K., Fopstorh U. Computer crimes. Guidelines for Combating Computer Crimes. Per. from English IN AND. Voropaeva and G.G. Trehalina. - M .: Mir, 1999.

5. Semenov N.V., Motuz O.V. Forensic cybernetic examination is a tool for combating crime of the XXI century // Information protection, confidential, 1999, 1-2.

6. An automated workstation for carrying out forensic examinations of electronic media. Patent for invention of the Russian Federation No. 2297664 dated 20.04.2007.

List of figures

FIG. 1 is a diagram of an automated workstation for conducting computer forensic forensic examinations of plastic cards. The main elements of the system and the connections between them are shown.

FIG. 2 - a stencil for conducting computer forensic forensic examinations of plastic cards. The appearance of the stencil is shown.

FIG. 3 - a photograph of an automated workplace for carrying out computer forensic forensic examinations of plastic cards. The stencil is located in the scanner.

Claims (2)

1. An automated workstation (AWS) for conducting computer forensic forensic examinations of plastic cards, consisting of a Personal electronic computer (PC) 1 and a Stand for the study of electronic data carriers (ENI) 2, characterized in that it additionally contains a Contact reader 3, Proximity reader 4, Scanner 5 and Stencil 6, while the inputs of the ENI Research Stand 2, Contact Reader 3, Contactless Reader 4, Scanner 5 are the AWP inputs for conducting computer forensic examinations of plastic cards, information outputs of the ENI Research Stand 2, Contact reader 3, Proximity reader 4, Scanner 5 are connected to the information input of the PC 1, the control output of which is connected in parallel to the control inputs of the ENI research stand 2, Contact reader 3, Proximity reader 4, Scanner 5, Stencil 6 is located in the working area of Scanner 5. 2. A method of conducting computer forensic forensic examinations of plastic cards, comprising reading data from a magnetic stripe of a magnetic stripe card; the formation in the memory of the PC 1 of a large binary object as an information copy of the ENI, in the role of which is a card with a magnetic stripe; processing the blob with the hardware of the PC 1 using software to get answers to the questions posed to the expert; the formation of the final expert opinion, characterized in that it additionally contains scanning the appearance of the examined plastic card using a stencil; contact reading of data from a chip of a plastic card; contactless reading of data from a plastic card chip, adding images of the front and back sides and the data of a plastic card read from the chip into a large binary object.

Images