Typical inquiry situations and expert ways of their settlement
Date: November 05, 2003Source: Computer Crime Research Center
By:
... including expert examination results allowed proving guilty of Mr. F. and institute criminal proceedings against him.
3. The emulators of electronic keys are regarded now as detrimental programs. Expert examinations are required to fix facts of breaking licensed software passwords. Mr. N. illegally obtained data to produce a program equivalent to HASP code key that is a main element of protecting some author’s computer programs when transforming demonstrators to semi-functional versions. Mr. N. used these data to realize a program including files with activating code. The launch of this program resulted in modifying the activating code of the well-known bookkeeping software. As a result, the program started working in the semi-functional mode without electronic code key of the licensed product. The expert examination revealed acts and circumstances of using detrimental functions of the emulator program. Further, the accusation against the suspect was based on the results of expert examinations.
There are some typical situations connected with detecting and investigating crimes committed by using computer technique. This group of situations includes crimes of some categories, which are not provided directly by the Criminal Code articles but committed and/or concealed by using computer information (swindle, false business, money counterfeit and so on).
By the fact of swindle, the proceedings were instituted against an organized group of criminals who conducted a sideshow at one of the city markets. Three computers were withdrawn and sent to the expert examination. It should be determine if their playing program algorithms are capable of deliberately obtaining definite results and in what way. The experts disassembled the activating code of the playing program and realized its step-by-step activation in the program-debugging medium. The diagnosing signs were different program interruptions organizing the work with specific devices and input/output ports, as well as the use of definite address ranges. On the base of program algorithm analysis and its functioning peculiarities, the expert gave a positive categorical answer: variants of the game end were given at the program launch by using a keyboard and computer mouth. The correct expert examination allowed proving guilty of the criminals.
Model situations of establishing facts and circumstances of crimes where computers are sources of evidentiary information are attention-worthy as well.
1. The personal computer was withdrawn during the investigation in the office suite of Mr. M. by the fact of his murder. The computer-technical expert examination was set to reveal facts and circumstances of this criminal case and establish what information on the activity of Mr. M. and his connections in the period from 00.00.00. to the moment of withdrawal was in the computer. Except the hard disk system applied software it contained such programs as Outlook Express that allowed exchanging mail messages with Internet users and ICQ that made it possible to communicate in the online mode with several Internet users. The experts obtained an access to the Express Outlook received and sent letters, as well as ISQ archive of talks and addresses in the address book. They contained information on contacts of the murdered person in respect to his private business activity, illegal transactions and data of personal character, which finally helped to establish his murderers.
2. At the robbery attack on Mr. S., a private businessperson, one of the criminals was arrested. The electronic note book-organizer was found and withdrawn while examining the incident spot. The arrested person refused to give any evidences. Therefore, the computer-technical expert examination of the organizer was assigned. The address book information was protected with a password. There were three ways of resolving the expert problem occurred in that expert situation. First, the apparatus-program complex of organizer expert examinations should be used. However, the home experts do not have these tool means now. Second, the electric power should be cut off. Nevertheless, there is a great probability of losing all data. Third, the password has to be selected. The last variant was preferred and the password was lastly found. The study of data on the arrested person favored it. The password turned out to be an alphanumeric combination of the book owner’s birth date and initials. The expert examination established his connections (phone numbers, connection channels and so on) and revealed the organized criminal group consisting of 11 persons. Further, it played a significant role in detecting and investigating more than 20 heinous and especially grave crimes committed in the region [1].
According to the author, the most important thing in investigating computer crimes is to obtain prompt and adequate evidentiary and search information. Such data can be received during various expert examinations. Especially meaningful is the computer-technical examination that favors solving the main search problems: establishing facts of identity between the searched and detected computer equipment; finding desired computer information on the presented carriers; obtaining search data on the criminal’s professional characteristics and so on.
1. Material evidences. Edited by V.Y.Koldin. M., NORMA, 2002. – P.642-646.
Add comment
Email to a Friend
| Discussion is closed - view comments archieve |
| 2005-09-02 01:11:57 - Good blog Anelia |
| Total 1 comments |
