Standards for Digital Evidence

The objective of the research was to identify threats to individual rights in criminal proceedings during martial law. The research involved system methods, descriptive analysis, systematic sampling, doctrinal approach and forecasting. Martial law introduced as a result of armed conflict carries important implications for criminal justice. Ensuring the observance of individual rights in criminal proceedings during this period applies to several crimes, the common feature of which is the time of their commission. The classification of subjects of prevention of infringement of such rights is presented. The prospects for improving the protection of individual rights in criminal proceedings require international assistance in the detection of crimes related to the armed conflict. It is concluded that ensuring the observance of individual rights in criminal proceedings during martial law requires combining the efforts of national and international specialists. Prospects for improving this process envisage international assistance with increased use of its results as evidence in national and international courts. It is appropriate to develop international recommendations for national law enforcement agencies and judicial bodies.

The development of sixth‐generation (6G) wireless communication technology is expected to provide super high‐speed data transmission, and advanced network performance than the current fifth‐generation (5G) and be fully functional by the 2030s. This development will have a significant impact and add improvements to digital extended reality (XR), autonomous systems, vehicular ad hoc networks (VANETs), artificial intelligence (AI), underwater communications, blockchain technology, pervasive biomedical informatics and smart cities built on the digital infrastructure backbone of the Internet of Things (IoT). The ubiquitous nature of this large‐scale 6G‐enabled IoT that offers faster connectivity capabilities and integrates both terrestrial and non‐terrestrial networks will not only create new data security and privacy issues but also provide a treasure trove of digital evidence useful for digital forensic examiners investigating security incidents and cybercrime. However, for digital forensic examiners, evidence collection, preservation and analysis will become a priority in the successful deployment of 6G IoT networks. In this study, we define key applications of 6G network technology to the Internet of Things and its existing architectures. The survey introduces potential digital forensic challenges and related issues affecting digital forensic investigations specific to 6G IoT networks. Finally, we highlight and discuss forensic readiness and future research directions for identified challenges within the 6G IoT network environments.This article is categorized under: Digital and Multimedia Science > IoT Forensics

Abstract: EU action in the field of procedural rights in criminal proceedings was expected. The effects on procedural rights of the EU‐propelled increase of repressive, cross‐border efficiency with the application of the principle of mutual recognition could not fail to be noticed, and doctrinal opinion has been outspokenly critical of the current predominance of the ‘security’‐element over the other two in the ‘area of freedom, security and justice’. Unfortunately, the proposed Framework Decision on certain procedural rights in criminal proceedings throughout the EU is a double failure: first, the Commission's methodological choices betray a cavalier attitude to the limits of EU competence in this area. Second, it is also a substantive failure in that the rights selected as being ‘so fundamental that they should be given priority at this stage’ do little to solve the problems actually besetting the application of the principle of mutual recognition in criminal matters.

In the implementation of Digital Forensics, one of the derivatives of practice is the handling of Digital Evidence. Handling Digital Evidence requires important steps and procedures. Digital evidence is a source of artifacts in handling a digital-based crime case, one of which comes from digital storage. In this research, the author will design a framework for Digital Forensic investigations by simulating digital evidence in the form of a non-volatile architecture. The reference commonly used by researchers in previous articles is the National Institute of Justice (NIST). The framework is a reference and steps in the practice of acquiring digital evidence. The purpose of designing this framework is as a legal procedure that is specifically implemented in the practice of acquiring non-volatile digital evidence. In the design, the author conducted a literature study on the NIST SP 800-86 and ISO 27037:2012 standards and then combined them in a hybrid terminology. The output of this research is to combine the two standards to become framework as reference for handling and investigating Digital Forensic science.

The budding progress and relevance of digital information technology in quite a few areas of business, engineering, medical, agricultural and scientific studies are resulting in data explosion coined by the term “big data”. The dependency on digital media drives and devices has enlarged the dimensions of data formation and storage exponentially around the world, with a need of keeping a record of what data is accumulated and how the data is exercised. So it has raised an alarm of security for the data asset. To discover the pattern of interest leading to a decision from these voluminous data has put forth a challenge for the law enforcement and investigative agencies. Also, tracing such type of misutilization of digital technology in a big data age from the perspective of digital forensics requires minute bit-level examination and observations to locate the digital evidence that explains how maliciously nefarious activities have been done and by whom with the possible extent of the damage. The forensic examination and analysis in such a big data era requires appropriate digital investigation model with the application of tools, techniques and methodologies to boost decision-making and diagnostic process for advanced outfitted competence in digital forensic investigation with the intent of assembling valuable evidence from it. So, the need of the hour is to have a holistic outlook of the big data challenges and opportunities for its application in the digital forensic domain with the goal of making full-bodied investigation pronouncements. Much work has been done to model digital investigation as well as digital evidence but a comprehensive correlated and aggregated merging of voluminous data coming from different heterogeneous sources along with timely and accurate detection and analysis is the need of the hour. This chapter depicts the trends of digital forensics served for big data and the challenges of evidence acquisition, and further suggests the revision of the existing fusion-based digital investigation model by highlighting the formalization, quick detection and timely accurate analysis of digital evidence from multiple sources simultaneously. The modification adopted the inclusion of look-up table into the architecture with the application of data fusion to practice voluminous data effectually.

Chapter 6 - Digital Forensics at Work in the Legal System

The article advances a system-integrated procedural and legal model for the use of digital technologies and evidence in criminal proceedings concerning offences against the foundations of Ukraine’s national security. It shows that the lack of an autonomous definition of “digital evidence” in the Criminal Procedure Code (CPC), the underdevelopment of procedures for collection, authentication and preservation, as well as shortages of certified tools and trained personnel, generate legal uncertainty and risks of inadmissibility. Against the backdrop of international standards of the ECtHR (notably Benedik v. Slovenia, Uzun v. Germany) and the CJEU’s approach in Case C-670/22 (EncroChat), the article substantiates: (1) a unified admissibility test for electronic evidence–“provenance – disclosure – reproducibility”–and its operationalisation through a judicial benchbook with model reasoning; (2) a procedure for open-source digital forensics (OSINT-forensics) with requirements for capture, chain of custody, and audit trail; (3) an algorithm for judicial verification of coordinates (double projection; cross-validation with telecom logs/official statements; access logging) to verify geodata and cartographic materials. It proposes statutory incorporation of minimum standards for the procedural circulation of digital evidence in the CPC (including rules for inspecting web resources and handling data from cloud services/mobile apps), sub-statutory interagency digital-forensics instructions, and institutional mechanisms (accredited laboratories; a register of validated methods). It is demonstrated that systemic implementation of these measures enhances the probative reliability of digital materials, ensures compatibility with the “internal equivalence” principle in the cross-border circulation of electronic evidence, and strengthens guarantees of a fair trial.

Information technology systems are attacked by offenders using digital devices and networks to facilitate their crimes and hide their identities, creating new challenges for digital investigators. Malicious programs that exploit vulnerabilities also serve as threats to digital investigators. Since digital devices such as computers and networks are used by organisations and digital investigators, malicious programs and risky practices that may contaminate the integrity of digital evidence can lead to loss of evidence. For some reasons, digital investigators face a major challenge in preserving the integrity of digital evidence. Not only is there no definitive comprehensive model of digital forensic investigation for ensuring the reliability of digital evidence, but there has to date been no intensive research into methods of doing so. To address the issue of preserving the integrity of digital evidence, this research improves upon other digital forensic investigation model by creating a Comprehensive Digital Forensic Investigation Model (CDFIM), a model that results in an improvement in the investigation process, as well as security mechanism and guidelines during investigation. The improvement is also effected by implementing Proxy Mobile Internet Protocol version 6 (PMIPv6) with improved buffering based on Open Air Interface PIMIPv6 (OAI PMIPv6) implementation to provide reliable services during handover in Mobile Node (MN) and improve performance measures to minimize loss of data which this research identified as a factor affecting the integrity of digital evidence. The advantage of this is to present that the integrity of digital evidence can be preserved if loss of data is prevented. This research supports the integration of security mechanism and intelligent software in digital forensic investigation which assist in preserving the integrity of digital evidence by conducting experiments which carried out two different attack experiment to test CDFIM. It found that when CDFIM used security mechanism and guidelines with the investigation process, it was able to identify the attack and also ensured that the integrity of the digital evidence was preserved. It was also found that the security mechanism and guidelines incorporated in the digital investigative process are useless when the security guidelines are ignored by digital investigators, thus posing a threat to the integrity of digital evidence.

Digital evidence is information of probative value that is either stored or transmitted in a digital form. Digital evidence can exist as words (text), sound (audio), or images (video or still pictures). Law enforcement and forensic scientists are faced with collecting and analyzing these new forms of evidence that previously existed on paper or on magnetic tapes. They must apply the law and science to the processes they use. Extrapolating the old processes into the new formats has been proceeding since the 1980's. Regardless of the output format, all digital evidence has a certain commonality. One would assume that the rules of evidence and the scientific approach would also have some common characteristics. Obviously, there is also a divergence due to the differences in outputs. It is time to approach the issues regarding digital evidence in a more deliberate, organized, and scientific manner. The program outlined by the NCFS would explore these various formats, the features common to traditional types of forensic evidence, and their divergent features and explore the scientific basis for handling of digital evidence. Our web site, www.ncfs.org, describes our programs.

BCFL logging: An approach to acquire and preserve admissible digital forensics evidence in cloud ecosystem

This paper reviews the existing methodologies and best practices for digital investigations phases like collecting, evaluating and preserving digital forensic evidence and chain of custody of cybercrimes. Cybercriminals are adopting new strategies to launch cyberattacks within modified and ever changing digital ecosystems, this article proposes that digital investigations must continually readapt to tackle cybercrimes and prosecute cybercriminals, working in international collaboration networks, sharing prevention knowledge and lessons learned. The authors also introduce a compact cyber forensics model for diverse technological ecosystems called Cyber Forensics Model in Digital Ecosystems (CFMDE). Transferring the knowledge, international collaboration, best practices and adopting new digital forensic tools, methodologies and techniques will be hereinafter paramount to obtain digital evidence, enforce organizational cybersecurity policies, mitigate security threats, fight anti-forensics practices and indict cybercriminals. The global Digital Forensics community ought to constantly update current practices to deal with cybercriminality and foreseeing how to prepare to new technological environments where change is always constant.

This study examined the impact of technology on digital forensics and the challenges faced by forensic accountants in the era of cybercrime. The study highlights the four dimensions in which technology has an impact on digital forensics: technical, legal, organizational, and educational. The paper also discusses how emerging technologies such as artificial intelligence and machine learning can be used in digital forensics, along with the challenges they present. Cloud computing is also examined, and the challenges it poses for forensic accountants who need to access and analyze financial data stored or processed in the cloud are discussed. The research used a qualitative research design and incorporated the chain of custody theory in digital forensics. The findings of this study suggest that forensic accountants need to update their knowledge and skills in digital forensics to keep up with the latest trends and technologies in cybercrime in Nigeria. It is recommended that forensic accountants adopt a multidisciplinary approach that integrates accounting principles with digital forensics methods and tools. Additionally, following best practices and guidelines for digital evidence collection, preservation, analysis, and presentation is crucial to ensure the integrity, reliability, and admissibility of digital evidence in court.

The article is devoted to one of the effective means of obtaining evidence in criminal proceedings – temporary access to things and documents, the legal regulation of which is defined in Chapter 15 of the Criminal Procedure Code of Ukraine. Attention is drawn to a number of problematic issues related to the prosecutor's use of temporary access to things and documents in the exercise of the function of prosecution, the presence of which does not ensure the effectiveness of criminal procedural evidence and the effectiveness of this institution in criminal proceedings. According to the results of the study, the author concludes that the use of temporary units to temporarily access things and documents on the basis of a prosecutor's order makes it impossible to recognize the results of such action as evidence in criminal proceedings, as they do not meet the admissibility requirement. Prosecutorial oversight in criminal proceedings should not only ensure the inevitability of criminal punishment, but also ensure proper respect for human rights in criminal proceedings, respect for the individual, treatment as a person whose guilt has not yet been proven, and ensure impartiality and objectivity of the pre-trial investigation. Based on the results of the analysis of the decisions made by the investigating judge based on the results of consideration of the petitions, the author identified the grounds for the prosecutor's refusal to satisfy these petitions by the investigating judges. It is proposed to expand the procedural powers of the prosecutor as a subject of criminal procedural evidence, giving him the right to instruct operational units to conduct not only investigative (investigative) and covert investigative (investigative) actions, but also other procedural actions. Thus, taking into account the results of the analysis of scientific literature and materials of law enforcement practice, we can conclude that it is necessary to expand the procedural powers of the prosecutor as a subject of criminal procedural evidence by stating paragraph 5 Рart 2 of Art. 36 of the Criminal Procedure Code of Ukraine in the following wording: «to instruct the investigative (search) actions and covert investigative (search) actions or other procedural actions to the relevant operational units», as well as the need to supplement Part 1 of Art. 41 of the Criminal Procedure Code of Ukraine by the authority of operational units to carry out other procedural actions on behalf of the prosecutor.

The article examines the legal regulation of the principle of proportionality in criminal proceedings under martial law. During the statement of the problem, it is noted that restrictions on human rights and freedoms during martial law must be commensurate with the specific situation of danger and the need to carry out effective criminal proceedings. In the course of disclosing the state of development of the relevant issues, it is noted that despite the fact that scientists paid attention to some aspects of the proportionality of the limitation of human rights and freedoms in the criminal process, there are currently separate problems of legal regulation of the principle of proportionality in criminal proceedings under martial law. During the presentation of the main material, it is indicated that the principle of proportionality should be used in every case of possible limitation of the fundamental right of a person in criminal proceedings. It is emphasized that the recognition of the principle of proportionality at the legislative level will protect against possible regulatory gaps regarding the requirement of proportionate restriction of human rights in criminal proceedings. Attention is focused on the fact that the normalized general principle of proportionality should apply to all circumstances of excessive procedural interference with the rights of a person, which cannot be comprehensively predicted objectively in the legislative prescriptions. It is emphasized that in criminal proceedings under martial law, in addition to the general principle of proportionality, a special principle of proportionality must be observed, which is related to the need to take into account the severity of the combat situation during the implementation of criminal procedural activities and ensure the rights of participants in criminal proceedings. It is concluded that the special principle of proportionality should be regulated in such a way as to potentially apply to all possible situations of criminal proceedings during martial law. It is determined that criminal procedural law must "require" that a special principle of proportionality be assessed in relation to each case of departure from the general procedure of criminal procedure. It is concluded that by applying the special principle of proportionality, the proportionality between the state (public) interest, enhanced by the "security" component, and the private interest is determined.

The last decade has seen the EU place unprecedented emphasis on increasing and improving cooperation between Member States in criminal justice matters. However, for most of this period the fundamental rights of suspects and defendants have been largely ignored. In recognition of this, the EU adopted the Roadmap for strengthening the procedural rights of suspected or accused persons in criminal proceedings in 2009. This paper examines the steps necessary to establish an effective and coherent system of EU criminal justice procedure: one which enables Member States' prosecution and judicial authorities to cooperate effectively in the fight against serious cross-border crimes, while also ensuring efficient protection for the fundamental rights of suspects and defendants. It looks at the progress that has been made under the Roadmap and the work that remains to be done. Fair Trials International's case studies are used to demonstrate the dangers of introducing mutual recognition instruments such as the European Arrest Warrant for prosecutors when suspects and defendants do not have tangible, enforceable fair trial rights in many EU countries.