'Forensics'에 해당되는 글 3건

  1. 2010.12.16 CSI Effect!? (2)
  2. 2009.11.15 Encase ?? Naive Forensics??
  3. 2009.11.01 KUCIS 발표자료

Have you ever heard about The CSI effect (or CSI syndrome)?

Huge hit of CSI series changes not only market of soap opera but a court. after its debut, atmosphere of a court somewhat changed.  juror is not what s/he used to be. jury demand prosecutor or plaintiff evidences more forensically sound. 

CSI effect refers to juror's change of attitude. 

with broadcasting of CSI, people begin to be interested in Forensics. and judy could play a important role in court regarding forensics.

here as where else, CSI series produce both good effect and advert effect. with CSI's performance, jury have a illusion that every evidences could be processed in forensically sound way in just 3 days. but it's almost impossible. and jury demand too many evidences though it's unconnected.


in brief, CSI effect is like below.

Investigator : 
Investigator have to gather much more evidences.
but, they have no time, no money, no space to store evidences.
with small mistake in processing a evidence, they could not maintain a admissibility.

Juror : 

s/he is smarter than before. s/he is a Quasi-expert.

but sometimes, s/he make an unreasonable demands to investigator.

Criminal : 
now criminal knows how to escape, how to erase their trace and how to blur a admissibility.
they learned these from CSI!!

the judiciary impose the jury system since Feb 2008. actually, Korean jury system not a jury system but Schoffengericht system. it's system beyond reason. but, processing a digital evidences is almost identical of American's.

CSI effect would be a picture of Korea. we have to make a preparation for CSI effect.

Posted by 퍼덕퍼덕

Digital Forensics에서 Tool은 굉장히 중요하다.
특별한 반론의 여지가 없는한 디지털증거의 증거능력을 인정받기에 가장 유용한 방법은 공신력있는 툴을 이용하는 것이기 때문이다.

Guidance社의 Encase...
훌륭한 툴임에는 틀림없으나 상용이고 비용도 매우 비싸다.

Digital Forensics를 공부하는 학생입장에서 Encase를 구입하는 것은 실질적으로 매우 곤란하다.
결국 해결책은 Naive Forensics인데...
단언하자면 Naive Forensics를 통해 얻은 디지털증거는 증거능력이 없다...

하지만 공부하기엔 최대한 low level로  공부하는게 좋으니까
Encase보단 WinHex, sysinternals 패키지로 공부하는 게 좋을것 같다

Posted by 퍼덕퍼덕
Paper2009.11.01 17:01