国产及山寨手机中QQ聊天记录恢复、提取的探讨

通过分析国产及山寨手机的软件结构特征,发现QQ数据的存储规律,结合实例介绍在国产手机、山寨手机上应用取证分析工具对QQ数据进行解析、提取的步骤、方法。     

云会计下会计司法鉴定取证与证明的探讨与研究

云会计的出现加速了我国会计信息化建设的进程。同时,对会计司法鉴定的取证工作也带来了新的机遇和挑战。以云会计的特点为出发点,进一步提出云会计环境下取证与证明活动的基本要求,并就云会计环境下会计司法鉴定取证与证明中可能存在的新挑战进行探讨和分析。     

民事诉讼案件中可疑文件制作方法研究

从司法鉴定角度来看,民事诉讼案件中的可疑文件与刑事案件中的文件物证相比,虽具共性又各有其特点。以构成可疑 文件各要素为出发点,对该类文件制作方法及其特点进行研究,以利于拓宽检验鉴定思路。     

逆向分析在电子数据取证中的应用——以“QQ密码大划拉”为例

逆向分析是恶意程序取证的常用方法之一,在揭示恶意程序意图及行为方面发挥着其他方法无法比拟的作用。在对逆向分析基本概念、方法、工具进行介绍的基础上,结合中国大陆地区一起利用恶意程序窃取QQ账号与密码的真实案例,从查壳、脱壳、断点设置、程序跟踪、关键信息获取等方面详细描述了针对恶意程序进行逆向分析的全过程。     

2009年度全国“三大类”司法鉴定情况统计分析

2009年司法鉴定工作在统一管理体制目标的统领下,贯彻落实中央21号文件和全国人大常委会《关于司法鉴定管理问题的决定》,全面加强司法鉴定队伍、机构、制度、业务、科研等五个方面的建设,促进司法鉴定行业的发展。对“三大类”司法鉴定情况进行统计分析,旨在总结回顾司法鉴定管理工作既已取得的成绩,推动司法鉴定事业继续健康发展。     

对我国司法鉴定制度的思考

对我国司法鉴定制度的思考金光正司法鉴定是利用现代科学技术对与司法工作相关的人、事、物的属性、异向和因果关系等所进行的检验与评断。它是把现代科学知识与检验手段引人司法工作领域，发现与评断证据，对证据事实认以的升华和再认识，以提高取证率、证据利用率及其证...     

第三届全国计算机取证技术研讨会述评

2010年11月27日上午,第三届全国计算机取证技术研讨会在华东政法大学隆重举行。本次会议由上海市犯罪学学会和中国电子学会计算机取证专家委员会、华东政法大学共同主办,《犯罪研究》杂志和厦门市美亚柏科信息股份有限公司、华东政法大学司法鉴定中心、     

电子数据司法鉴定工具可靠性评估研究

探讨建立对电子数据司法鉴定工具进行科学性及可靠性的评估方法。在已有的国内外取证工具评测方法的基础上,借鉴国家强制认证认可和可靠性工程等因素,对电子数据司法鉴定工具可靠性评估体系中的工具基本认可和定性评估二阶段进行详细分析,为保证司法鉴定实践的科学性和准确性提供理论依据。     

简讯

《司法鉴定机构质量体系文件》喜获科研成果一等奖由杜志淳、沈敏主编的《司法鉴定机构质量体系文件》获第二届全国法学教材与科研成果一等奖。作为杜志淳、沈敏主持的2003年度司法部理论研究课题和2002年上海市重点项目“司法鉴定机构质量保证体系研究”的科研成果之一,该书以文件的形式阐述了司法部司法鉴定科学技术研究所开展的司法鉴定质量管理活动的情况,提供了一套完整的司法鉴定内部管理方法和司法鉴定工作制度,这对强化司法鉴定机构内部管理,规范司法鉴定活动有重要的指导意义和借鉴价值。于2005年10月1日实施的全国人大常委会《关…     

电子取证在苏州检察机关的运用与实践

随着电子数据技术的飞速发展和广泛应用,电子取证技术已经成为侦查破案、诉讼审判等司法活动中越来越重要的技术手段。苏州市人民检察院电子取证工作从2008年开始进行探索与实践,在全国检察机关起步较早。通过几年的实践,电子取证技术队伍逐步健全,鉴定能力不断提升,实验室多名技术人员获得检察机关电子取证鉴定资格。2011年10年,市院电子取证实验室通过了CNAS国家认可现场评审,电子物证检验鉴定门类通过专家评审在江苏省检察机关为第一家,标志着苏州市检察院司法鉴定实验室进一步迈入科学化、规范化轨道。本文结合几年来的探索实践,分析电子取证的内涵、电子取证的原则和方法以及苏州检察电子取证工作发展的构想。     

计算机软件、软件复制品、电磁记录之保护与计算机信息交易立法——从盗窃腾讯QQ号码案说起

腾讯QQ是一种具有即时通讯功能的计算机软件，和软件复制产品、电磁记录一样都属于计算机信息。盗窃腾讯QQ号码的实质是盗窃腾讯QQ软件复制品。计算机软件是著作权法的客体，而作为无体物的软件复制品和电磁记录却不能构成物权法的客体，只能视为动产给予保护。我国应该借鉴美国统一计算机信息交易法的立法经验，加紧制定计算机信息交易法以规范计算机信息交易，填补相关法律漏洞。     

大陆首例QQ号码盗窃案的法律适用探讨

通过对我国大陆首例QQ号码盗窃案的法律适用问题的分析,指出在罪刑法定原则下,对此类案件以盗窃罪论处缺少充分法律依据,建议通过完善计算机犯罪、侵犯通信自由罪以及建立对虚拟财产独立的法律保护体系,来应对此类新型犯罪。     

Recovering erased digital evidence from CD-RW discs in a child exploitation investigation

The paper describes an innovative method used to recover digital images and videos from an evidentiary CD-RW disc that had been erased. The digital evidence had been erased by the subject of the investigation in an attempt destroy incriminating evidence of the crime. Without the recovery of the digital evidence, there would have been no conviction in the child exploitation case as there was no physical or testimonial evidence.     

The right to a fair trial as a conceptual framework for digital evidence rules in criminal investigations

Digital evidence and digital forensics have a significant impact on criminal investigation. This requires an examination if the fair trial principle remains sound in the new domain.In this paper the right to a fair trial in Art. 6 ECHR and its interpretation in case law is analysed in order to clarify its connection to evidence law and its specific application to the investigation stage of criminal proceedings. It is argued that the principle implicitly enshrines a framework for the development of universal evidence rules . Derived are two-groups of evidence rules: equality of arms based and presumption of innocence based. For each group specific challenges in the digital investigation are outlined and discussed in the context of a new governance model for digital evidence.     

Investigating the uses of mobile phone evidence in China criminal proceedings

Data from mobile phones are regularly used in the investigation of crime and court proceedings. Previously published research has primarily addressed technical issues or provided operational manuals for using forensic science evidence, rather than analysing human factors and the implementation of forensic tools in investigation settings. Moreover, previous research has focused almost entirely on western countries, and there is a dearth of research into the uses of forensic evidence in China. In this study, a review was carried out of court sentencing documents referring to mobile phone evidence in China over the period 2013–2018. Automated content analysis was used to identify the specific evidence types utilised and the sentencing outcome for each case. Results show that mobile phone evidence was used in 3.3% of criminal proceedings. Among various data types mentioned in criminal proceedings, call records sustained as the most frequently used type of data. After which, instant messaging tools (e.g. WeChat) are an increasing proportion of all mobile phone evidence, from 1% in 2015 to 25% in 2018. For cases that utilised mobile phone data, the analysis of instant messaging and online transaction tools is routine, with little variation in the use of each application (WeChat, Alipay, QQ) for investigations of different types of crime. However, in the majority of criminal cases, mobile phone data function as subsidiary evidence and posed limited impacts on verdict reached. The current findings indicate that a large amount of mobile phone evidence was transformed into other evidence formats or filtered out directly before court proceedings.     

电子证据的相关问题

在美国，使用电子证据已经成为法庭上非常普遍的现象。陪审团审案时，试图使用电子证据的检察官要想使得初审法官采纳该电子证据必须克服一些阻碍。一些证据标准被设计来限制陪审团的事实发现过程。检察官可要求法院启动庭前审理程序来决定电子证据是否可以被采纳。建立一个电子证据保管链和专门处理电子证据的既定机构程序是检方工作的关键环节，这样能确保法庭调查中获得陪审团的信任。挑选能认同电子证据重要性的人员担任陪审团成员非常重要，同时还要避免选择那些想要根据自己专业知识来主导陪审团决议的人员。     

论计算机取证相关问题——现场动态分析，获取“易挥发”数字证据

由于目前计算机专业取证人员数量的不足，当前司法实践中对于现场中正处于运行状态的计算机大多采用“二步式”取证的方式来搜集数字证据。即先由侦查人员对涉案计算机实施关机分离和保全。尔后再移交专业机构进行数字证据司法鉴定。这种方式虽然保障了数字证据的原始性和证明力。但无形之中造成了存储在RAM中的“易挥发”数据以及其他形式的潜在数字证据的丢失。而计算机信息系统中的这些“易挥发数据”可以为案件的侦破提供重要线索和潜在的数字证据。因此通过对侦查人员的专业培训．实现“易挥发数据”的现场动态获取和合理保全对数字案件侦查取证意义重大。     

The use of self-organising maps for anomalous behaviour detection in a digital investigation

The dramatic increase in crime relating to the Internet and computers has caused a growing need for digital forensics. Digital forensic tools have been developed to assist investigators in conducting a proper investigation into digital crimes. In general, the bulk of the digital forensic tools available on the market permit investigators to analyse data that has been gathered from a computer system. However, current state-of-the-art digital forensic tools simply cannot handle large volumes of data in an efficient manner. With the advent of the Internet, many employees have been given access to new and more interesting possibilities via their desktop. Consequently, excessive Internet usage for non-job purposes and even blatant misuse of the Internet have become a problem in many organisations. Since storage media are steadily growing in size, the process of analysing multiple computer systems during a digital investigation can easily consume an enormous amount of time. Identifying a single suspicious computer from a set of candidates can therefore reduce human processing time and monetary costs involved in gathering evidence. The focus of this paper is to demonstrate how, in a digital investigation, digital forensic tools and the self-organising map (SOM)--an unsupervised neural network model--can aid investigators to determine anomalous behaviours (or activities) among employees (or computer systems) in a far more efficient manner. By analysing the different SOMs (one for each computer system), anomalous behaviours are identified and investigators are assisted to conduct the analysis more efficiently. The paper will demonstrate how the easy visualisation of the SOM enhances the ability of the investigators to interpret and explore the data generated by digital forensic tools so as to determine anomalous behaviours.