TFL Vsebine / Revija SIR*IUS

Coexistence and synergy of COBIT 5 and ISO/IEC 27001/27002

Preiskovanje digitalnih dokazil je kot izlet v preteklost, vendar potrebujemo informacijo o tem, kdaj in kam v preteklost želimo odpotovati. Obstoj stvari/dokazil na računalniku je običajno danost. Pomembna vprašanja so: Kako so prišla tja, kdaj so prišla in ali je kdo vedel, da so prišla? Namen je pomemben pri obravnavi, vendar dokaz sam molči o tem in tako se namen dokazuje z okoliščinami. Pogosto se od forenzičnega preiskovalca zahteva, da pridobi dokaze, ki podpirajo ali izpodbijajo posebnost primera, kar samo po sebi opredeljuje delo, ki ga je treba opraviti. Dejstva so absolutna, mnenja so osebna. Dejstva morajo podpreti mnenja, vendar je vprašanje, ali je vedno tako. Predavanje bo obravnavalo dobre, slabe in grde strani forenzičnega preiskovanja

Examination of digital evidence is an excursion into the past, but just like any time traveller we need to know where and when in the past we have travelled to. The existence of items on a digital device is usually a given. The important questions are: how did it get there, when did it get there and did anyone know that it was there? Intent is a very important consideration, but the evidence is usually silent on this and intent is often proved circumstantially. The forensic examiner is often asked to either look for evidence to support, or disprove a specific case and this in itself may provide a bias to the work they undertake. Facts tend to be absolute, but opinion is personal. The facts should support the opinion, but is this always the case? This presentation will cover the good, the bad and the ugly aspects of digital forensics.