Forensic examinations in the field of information technology: some problems of preparation and conduct

The article is devoted to the problems of preparing and conducting forensic examinations in the field of information technology. In particular, the author examines such types of expert studies as the study of computer hardware and software products and telecommunication systems and facilities. The Criminal Code of Ukraine contains Chapter XVI, which provides for liability for criminal offences in the field of information technology. The forensic methodology for investigating these criminal offences provides for the appointment and conduct of these types of forensic examinations as de facto mandatory. These types of forensic examinations are also appointed in the investigation of other criminal offences in which computers, mobile phones (smartphones), flash drives were used as tools or means (espionage, murder, tax evasion, duties (mandatory payments), terrorist financing, mass riots, etc.)These examinations are carried out in cases where it is necessary to establish factual data and certain actions committed with the help of electronic technical means that are relevant to criminal proceedings. In addition to the possibilities of these examinations, the article also highlights some problems related to the preparation and conduct of expert studies. For example, it is noted that in order to create an image or copy of the investigated hard drive on his computer, the expert must have a storage medium of at least the same capacity. And if several personal computers or servers with RAID-based disc arrays are sent for examination, the cost of replaceable storage media for copying data may hinder the successful conduct of the examination. It is determined that the peculiarity of the examination is that in the case of the study of software objects and the impossibility of working with their copies, changes almost always occur in file systems and registers of technical devices (for example, when they are switched on). This situation requires the expert to obtain permission to use so-called destructive (partially destructive) methods. The paper also discusses the peculiarities of preparing materials for expert research.