Advanced Framework for Digital Forensic Technologies and Procedures*

Abstract: Recent trends in global networks are leading toward service‐oriented architectures and sensor networks. On one hand of the spectrum, this means deployment of services from numerous providers to form new service composites, and on the other hand this means emergence of Internet of things. Both these kinds belong to a plethora of realms and can be deployed in many ways, which will pose serious problems in cases of abuse. Consequently, both trends increase the need for new approaches to digital forensics that would furnish admissible evidence for litigation. Because technology alone is clearly not sufficient, it has to be adequately supported by appropriate investigative procedures, which have yet become a subject of an international consensus. This paper therefore provides appropriate a holistic framework to foster an internationally agreed upon approach in digital forensics along with necessary improvements. It is based on a top‐down approach, starting with legal, continuing with organizational, and ending with technical issues. More precisely, the paper presents a new architectural technological solution that addresses the core forensic principles at its roots. It deploys so‐called leveled message authentication codes and digital signatures to provide data integrity in a way that significantly eases forensic investigations into attacked systems in their operational state. Further, using a top‐down approach a conceptual framework for forensics readiness is given, which provides levels of abstraction and procedural guides embellished with a process model that allow investigators perform routine investigations, without becoming overwhelmed by low‐level details. As low‐level details should not be left out, the framework is further evaluated to include these details to allow organizations to configure their systems for proactive collection and preservation of potential digital evidence in a structured manner. The main reason behind this approach is to stimulate efforts on an internationally agreed “template legislation,” similarly to model law in the area of electronic commerce, which would enable harmonized national implementations in the area of digital forensics.     

物证鉴定视野下的物质转移理论诠释与定位

物质转移理论起源于20世纪初叶,随着物证鉴定理论与实践的发展和完善,物质转移理论的内涵也不断深化。现代意义上的物质转移理论主要研究客观存在的物体在外力作用下,相互之间发生的物质交换及转移。作为物证鉴定基础理论之一,物质转移揭示出的客观规律对物证技术,尤其是物证鉴定工作具有重要的指导意义。该理论作为诉讼案件中获取鉴定材料的科学基础,其价值不仅在于为确定鉴定方法提供了有力依据,更为物证鉴定提供了重要的理论支撑。     

论审前程序改革对我国证据制度的影响——兼评举证时限制度在我国的确立

审前程序的改革一直是民事诉讼法学探讨的前沿问题,也是司法实践中亟待解决的重要问题。随着我国《证据规定》的颁布和实施,我国的审前程序得到了完善和发展,对我国的证据制度也产生了重要影响。我国已初步确立了举证时限、证据交换等制度,但也存在需要完善之处。     

非法证据的有限排除主义之惑——对《非法证据排除规定》五大理论问题之解读

《关于办理刑事案件排除非法证据若干问题的规定》在对非法证据尤其是非法言词证据的界定、非法证据的证据能力之排除及证明责任的分配、证明标准的设计方面具有开创性的意义。但从该文本在非法实物证据及其排除方面的阙如、对非法言词证据排除在程序设计上的不彻底性等几个方面来看,它所设定的仍是一种对非法证据有保留地排除制度,遵循的其实是非法证据的有限排除主义,因而有进一步完善的必要。     

犯罪的标尺——浅议我国犯罪证明标准的相关问题

我国未来的犯罪证明标准应当是层次式和分解式相结合的体系,即以一个高度盖然的总体证明标准为顶端,在该顶端下分别以侦查、起诉和审判三阶段的完结条件为标志设立阶段性证明标准。对于总体证明标准,在将法条修正为:"证据事实清楚,证据材料确实、充分"的同时,必须不断完善刑事诉讼程序使之更为正当和合理,而且还应增强司法主体的证据意识;而在刑事诉讼各阶段,则根据该阶段的直接任务分别设立相应的阶段性证明标准。     

论我国行政证据制度

随着服务政府理念的提出及盛行,行政权日益膨胀,已经渗入到社会的每个角落,故对行政权进行规制,保护公民权益日益成为各个国家行政立法的共同目标之一。从依法行政的角度来说,规制行政行为也就是要求行政主体在认定事实、适用法律的过程中根据行政证据来作出相应的行政行为。这就要求我们建立一个完善的行政证据制度。     

电子数据鉴定体系建设构想

电子数据鉴定工作在我国起步较晚,电子证据作为一种新型证据,由于其特有的属性,决定了证据的获取、检验、分析及展示均不同于传统证据,需要建立严密、科学规范的电子数据鉴定体系,保证电子证据的完整性、真实性及证明力。     

车辆上脱落细胞STR检验

目的对汽车方向盘及变速杆把手上的皮肤脱落细胞进行STR检验研究。方法用EZ-tape采集车辆方向盘及变速杆上的脱落细胞,Chelex-100法与磁珠法结合提取DNA,延长保温时间。定量后调整PCR反应体系,适当增加PCR循环数,增加PCR产物量及延长进样时间进行电泳检测,使用GeneMapperIDV3.2软件进行STR分型。同时,对比使用多重置换扩增技术对提取的DNA进行全基因组扩增。结果对33份车辆方向盘和变速杆上脱落细胞的检测,其中19份检出全部基因座的基因分型结果,9份检出部分基因型,5份未检出DNA分型结果。而利用多重置换扩增技术未获得满意图谱。结论本研究建立的脱落细胞收集、DNA提取、PCR扩增及检测方法适合于车辆上脱落细胞的检验,其结果优于使用多重置换扩增技术获得的分型。     

无罪推定原则在证据法中的体现

无罪推定是基于人生来无罪、也无犯罪基因这一常态而作出的一种假定。刑事诉讼程序是以证据为依据的动态逻辑证明过程并以证据为核心构件,因而,无罪推定原则在证据法中也具有重要意义。它在证据法中主要体现为以下具体规则：证据裁判主义、非法证据材料排除规则、无罪推定原则支配下的刑事诉讼证明与无罪推定原则下的证明责任。