隨著個人資料保護法即將正式實行，許多國內相關單位開始重視數位鑑識，以處理及因應未來與日俱增之資訊安全事件。數位鑑識實驗室的建置目前尚未有各國皆遵循的標準和流程，國內鑑識人員大多僅能按照所屬組織的規範和建議流程進行鑑識作業。本論文將藉由參考國際針對一般實驗室訂定的ISO17025及數位鑑識相關實務經驗，提出符合規範和適合實際鑑識流程的鑑識實驗室建構及處理標準之建議。 / With the Personal Information Protection Act will be formally implemented, many organization pay more attention to digital forensics to face information security events growing. But there is no standards and processes to build a digital forensics lab and investigators can only follow their teams’ specifications and process. This paper will give suggestions about the structure of digital forensics lab and standard operation process of digital forensics base on ISO17025 and practical experience.

This work contributes to the multi-disciplinary community of researchers in computer science, information technology and computer forensics working together with legal enforcement professionals involved in digital forensic investigations. It is focused on the relationship between scientific approaches underpinning digital forensics and the Islamic law underpinning legal enforcement. Saudi Arabia (KSA) is studied as an example of an Islamic country that has adopted international guidelines, such as ACPO, in its legal enforcement procedures. The relationship between Islamic law and scientific ACPO guidelines is examined in detail through the practices of digital forensic practitioners in the process of discovery, preparation and presentation of digital evidence for use in Islamic courts in KSA. In this context, the influence of religion and culture on the role and status of digital evidence throughout the entire legal process has been the main focus of this research. Similar studies in the literature confirm that culture and religion are significant factors in the relationship between law, legal enforcement procedure and digital evidence. Islamic societies, however, have not been extensively studied from this perspective, and this study aims to address issues that arise at both professional and personal levels. Therefore the research questions that this study aims to answer are: in what way and to what extent Islamic religion and Saudi culture affect the status of digital evidence in the KSA legal process and what principles the practitioners have to observe in the way they treat digital evidence in judicial proceedings. The methodology is based on a mixed-method approach where the pilot questionnaire identified legal professionals who come into contact with digital evidence, their educational and professional profiles. Qualitative methods included case studies, interviews and documentary evidence to discover how their beliefs and attitudes influence their trust in digital evidence. The findings show that a KSA judge would trust witnesses more than digital evidence, due to the influence of tradition, which regards justice and law to arise from the relationship between Man and God. Digital evidence, as it arises from the scientific method, is acceptable, but there is underlying lack of trust in its authenticity, reliability and credibility. In the eyes of the legal enforcement professionals working in all areas of the KSA legal process, acceptance of digital evidence in the KSA judicial system can best be improved if knowledge, education and skills of digital forensics specialists is improved also, so that they can be trusted as expert witnesses. This further shows the significance of KSA laws, regulations and education of digital forensic experts as the primary means for establishing trust in digital evidence. Further research following from this study will be focused on comparative studies of other Islamic non-Islamic legal systems as they adopt and adapt western guidelines such as ACPO to their religion, culture and legal systems.

Convergence of technology has made access to the Internet faster, easier and cheaper. Criminals, including paedophiles, child abusers and pornography traders make use of this technology to commit criminal offences. Computer Forensic Examiners (CFEs) are members of the Cyber Crime Unit, a professional, specialised unit of the South African Police Service (SAPS) who are responsible for computer forensic examination including the investigation of child pornographic images. The aim of the study was to seek understanding on what psychological effects the CFEs experienced when working with the images and was conducted from within the social constructionism and the narrative frameworks. The images had a severe impact on the CFEs as was clearly uncovered in the stories of six CFEs who participated in this study. The participants' stories were recorded and transcribed after which the application of thematic content analysis found that the participants all suffered similar negative effects. These findings were integrated with the findings of a focus group as well as with the findings of a similar study that was conducted during the same time by the Crimes against Children Research Center at the University of New Hampshire and resulted in identifying symptoms of trauma and stress experienced by the CFEs. Based on these results recommendations regarding the support for the CFEs were made. / Psychology / M.A. (Psychology)

No description available.

In contemporary encryption the vast amount of text subject to cracking has brought about the demand for methods distinguish files more likely to be encrypted. The encryption software Truecrypt can encrypt files that are not possible to identify with a file signature. To solve the detection problem, an algorithm sensitive to the absence of structure in the very code of files was developed. The program was written in the programming language EnScript which is built into the forensic software suite EnCase. The essential part of the algorithm therefore deployes the statistic of a chi-square test for deviance from a uniform distribution to distinguish files with contents that appear to be random. The program managed to detect encrypted files that were created with Truecrypt. Test results indicate that the newly developed program is nearly double as fast and has at least the same accuracy in the detection as other pro- grams. The software is licensed under open source standard GNU GPL. The procedure developed will drastically facilitate for computer forensic experts to detect if any existing encrypted file is located on the hard drive.

Convergence of technology has made access to the Internet faster, easier and cheaper. Criminals, including paedophiles, child abusers and pornography traders make use of this technology to commit criminal offences. Computer Forensic Examiners (CFEs) are members of the Cyber Crime Unit, a professional, specialised unit of the South African Police Service (SAPS) who are responsible for computer forensic examination including the investigation of child pornographic images. The aim of the study was to seek understanding on what psychological effects the CFEs experienced when working with the images and was conducted from within the social constructionism and the narrative frameworks. The images had a severe impact on the CFEs as was clearly uncovered in the stories of six CFEs who participated in this study. The participants' stories were recorded and transcribed after which the application of thematic content analysis found that the participants all suffered similar negative effects. These findings were integrated with the findings of a focus group as well as with the findings of a similar study that was conducted during the same time by the Crimes against Children Research Center at the University of New Hampshire and resulted in identifying symptoms of trauma and stress experienced by the CFEs. Based on these results recommendations regarding the support for the CFEs were made. / Psychology / M.A. (Psychology)