Експертні інформаційні технології у збиранні та дослідженні комп’ютерних даних

Abstract

Доведено, що експертна інформаційна технологія – це система наукових положень, правових норм і заснованих на них методичних та організаційних рекомендацій щодо практичного використання технічних засобів, програм, систем, інформаційних масивів і баз даних, які застосовують у процесі проведення судових експертиз для підвищення ефективності вирішення завдань зі збирання та дослідження комп’ютерних даних.

In the modern period of society’s informatisation, the growth of heterogeneous information resources, the development of information technology and the existence of traces of offences in the form of computer data serve as the basis for the formation of expert information technologies. Expert technologies for investigating traces of criminal offences are a type of forensic technologies used in criminal proceedings and represent a set of consistent procedures, operations, techniques and methods of using technical means to solve a task. Expert technology as an embodiment of an innovative approach to the practice of combating crime is considered to be a holistic structure of practical solution of expert tasks, including logistics, application of expert methodological, organisational and managerial measures. The main purpose of expert technology is the optimal combination of all structural elements of expert activity, which streamlines the process of their practical implementation. Expert information technology as a complex category includes theoretical, legal, methodological, organisational, hardware, software and information components. The article defines expert information technology as a system of scientific provisions, legal norms and methodological and organisational recommendations based on them regarding the practical use of technical means, programs, systems, information arrays and databases used in the process of conducting forensic examinations, with a view to improving the efficiency of solving the tasks of collecting and researching computer data. It is shown that there are three ways of implementing hardware, software and information components into expert technology: a) use of ready-made software and hardware information technologies; b) modernisation and transformation of existing information technologies with due regard for the specifics of the tasks performed by forensic examination; c) development of special expert information technologies. On the example of existing computer programs, the author demonstrates an experimental method of selecting a software product for solving the expert task of restoring destroyed computer data.