How can this be done professionally so that the evidence of criminal activities in cyberspace cannot be questioned? Such a topical problem was discussed by experts during the international scientific and practical round table “Adaptation and innovations in computer forensics in Ukraine during martial law: challenges, strategies and prospects” (June 4, 2024, Kyiv) . The leaders of the co-organizers of the event noted its relevance.
Director of the Ukrainian Research Institute of Special Equipment and Forensics of the Security Service of Ukraine, doctor of philosophy in the field of law, Yurii Chechil, in his welcoming speech to the participants of the event, noted that with the development of computerization, the wide use of various gadgets in everyday life, the possibility of hostile cyber attacks against Ukraine also expanded. And for criminologists, the tasks regarding the judicial prospects of evidence of cybercrimes are becoming more and more difficult. Therefore, the exchange of thoughts and ideas in the community of this field of forensics is an urgent task.
Valentin Kucheruk, director of the Computer Forensics Laboratory LLC, noted that Russia’s war crimes in cyberspace are becoming more and more daring, and that is why Ukrainian specialists are trying to expose and neutralize cyber terrorists, using the latest technologies and experience in implementing modern technical solutions.
Mykhailo Mozhaev, Director of the Scientific Research Center of Forensic Expertise in the Field of Information Technologies and Intellectual Property of the Ministry of Justice of Ukraine, focused the attention of his colleagues, in particular, on the fact that the development of appropriate methods for documenting cybercrimes needs to be significantly accelerated.
The executive director of the Computer Forensics Laboratory LLC, Serhii Denysenko, wished the participants fruitful work, exchange of experience and ideas capable of positively influencing the detection of crimes in cyberspace.
Oleksandr Ruvin, director of the Kyiv Scientific Research Institute of Forensic Expertise, noted that recently the number of computer-technical expertise appointments has significantly increased. Mr. Ruvin also expressed hope that the participation of the institution’s specialists in the work of the round table will be effective for the direct preparation of evidence in criminal proceedings, thanked the organizers for their cooperation.
Presenting a presentation “Virtualization in computer forensics”, Pavlo Malykhin, a leading specialist of the Center for Forensic and Special Expertise of the Scientific Research Institute of Special Equipment and Forensic Expertise (ISTE), provided comprehensive information about the advantages of such a method and noted that it has become an important tool for effective investigating digital crimes and ensuring cyber security. It is virtualization that allows experts to isolate and analyze digital evidence, minimizing the risk of its damage or loss. There is also a considerable economic effect from the introduction of such a method.
In a presentation on the topic: “Peculiarities of research on mobile devices using software and hardware complexes”, Oleksandr Yefimov, a specialist at the “Laboratory of Computer Forensics” LLC, not only described all methods of data extraction from mobile devices, but also convincingly demonstrated that, for example, mobile phones are capable of making changes to their file system under certain conditions, and as a result, even saving phone data cannot be proof that they have not been modified. The speaker also shared the experience of gaining access to the so-called “impregnable” gadgets for extracting information and decrypting databases.
With particular interest, the participants of the round table listened to the online speech of Toni Pjorn, Passware, “Find. Decrypt. Open.” and watched a video presented by a foreign guest from Estonia about the application of the company’s developments in the fight against criminal computer criminals. Passware products are used by the world’s leading law enforcement agencies to solve cases where decryption is required, with a success rate of at least 70 percent.
Prevention of terrorism, exploitation of children, rescuing hostages who were at gunpoint – all this is within the power of those who work with the products of this company. So Ukrainian specialists got acquainted with the ideas of the developers of the global anti-terrorist brand.
The project of the methodology “Research of smartphones”, developed together with Yurii Bortnyk and Iryna Bilovytska, was demonstrated to the participants of the round table by Maksym Zholondkivskyi, deputy head of the Department of the Center for Forensic and Special Examinations of the Institute of Special Equipment and Forensic Examinations of the Security Service of Ukraine. The product involves basic principles, processes, and best practices for collecting, analyzing, and interpreting data from smartphones in the context of peer-reviewed research. All stages of research are presented – from the preparation of the device, determination of its condition, isolation, availability of information protection to the selection of equipment and software for further information acquisition. All possible methods of information extraction, their pros and cons are analyzed.
The presentation of Ivan Starenky from the Odesa Scientific Research Institute of Forensic Expertise of the Ministry of Justice of Ukraine “Research of the Champion gaming service” aroused keen interest. The speaker, explaining the operation schemes of illegal casinos, told how the software products of the gambling service are monitored and investigated, what traces remain even when they are deleted, how the traffic examination is carried out, the scanning of the suspicious resource is carried out, visitors are tracked, and detailed information about the activities of the gambling establishment is collected.
The same topic was continued by Dmytro Sivalnev from the Institute of Special Equipment and Forensic Examinations of the Security Service of Ukraine with the presentation “Research of a computer with software that can be used for gambling.” The speaker told about the algorithm of actions necessary for competently fixing the work of computers, their extraction and packaging. They study the operating system, game software, files, network settings of computers, as well as search materials during investigative actions of the gaming establishment. All these measures require maximum accuracy to preserve valuable material evidence of conducting illegal business.
“Research of smartphones using a Bluetooth keyboard (mouse) emulator” was presented by Oleksandr Lazarev, Institute of Special Equipment and Forensic Examinations of the Security Service of Ukraine. He shared a “forensically clean” method of taking a screenshot of a smartphone screen, and also showed a device he invented, the use of which makes it much easier to find the necessary electronic information.
At the end of the round table, Maksym Yermolenko, the chief forensic expert of the Center for Forensic and Special Expertise of the Institute of Special Equipment and Forensic Examinations of the Security Service of Ukraine, made a presentation “Development of cyberattacks controlled by artificial intelligence, how hackers use artificial intelligence for complex attacks.”
The participants of the round table held a fruitful discussion on the problematic issues presented by the speakers and came to the conclusion that the increasingly frequent and difficult challenges faced by Ukrainian specialists in the fight against cybercrimes and terrorist cyberattacks should be met with operationally prepared and approved methods of detecting cybercriminals, fixing traces and prevention of their activities.
According to the results of the event, the organizers will prepare the Collection of Materials of the International Scientific and Practical Round Table.