行動惡意程式攻擊數位證據鑑識調查處理程序之研究

張志汖；林宜隆

行動設備 ； 惡意程式 ； 數位證據鑑識 ； 處理程序 ； 證據保管鏈 ； Action Equipment ； Malicious Code ； Digital Evidence Forensics ； Procedures ； Chain of Custody

電腦稽核

33期（2016 / 01 / 30）

1 - 21

繁體中文

鑑於行動網路與通信科技蓬勃發展，行動設備（ Mobile Devices），存有豐富的個人資訊能力，並具備高度機動性，和強大的軟硬體功能帶動各層面的廣泛運用，然而，手機詐財簡訊、多媒體簡訊與行動惡意程式攻擊等行動領域中的數位犯罪手法推陳出新，行動設備已成為許多犯罪者所使用的高科技犯罪工具。本研究首先針對行動惡意程式攻擊行為靜態分析，再進行深入的惡意程式動態分析，探討數位證據鑑識處理程序，研制有關行動設備數位證據的處理程序及規則。最後，利用行動通訊設備鑑識軟體作為的主要鑑識工具，讓鑑識人員能夠運用此鑑識程序與鑑識工具，即可完成鑑識工作，了解恰當的保護證據保管鏈（ Chain ofCustody, CoC），便於日後的調查分析提供數位證據，並於法庭上補強數位證據的完整性、一致性和精確性。

According to the massive development of mobile and communications technology, the mobile devices now are highly performed in personal information capacity and the mobility, both of the powerful hardware and software are encouraging the dependence of full aspects. Whereas, the means of the phone based swindles, MMS and mobile malicious code attacks also evolve everyday, which makes the mobile devices become the high-tech crime tool used by many offenders. First of all, this study will be directed against the static analysis of the malicious code attacks, and then conduct in-depth analysis of which dynamically to compromise digital evidence forensics procedures and regulations, then set them up. Accordingly, for the forensic officers, they can merely use the software against mobile communication as the main tools by following the procedure to accomplish their duty. This will ensure the proper preservation of evidence Chain of Custody （ CoC）, to facilitate proceeding investigation and analysis by providing digital evidence. Eventually, to reinforce integrity, consistency and accuracy of the digital evidence in the court of law.

1. 張志汖(2015)。數位證據保全。中華民國電腦稽核協會月刊，31
   連結：
2. 美國統一證據法則, http://law.upenn.edu/bll/ulc, last visited on August 4, 2015.
3. Wikipedia, Chain of custody, http://en.wikidia.org/wiki/Chain_of_custody, last visited on August 1, 2015.
4. Cardwell, Kevin,Clintonetc, Timothy(2007).The Best Damn Cybercrime and Digital Forensics Book Period.Syngress Media PRESS.
5. Casey, Eoghan(2002).Handbook of Computer, Crime Investigation.USA:ACADEMIC PRESS.
6. Chang, Chih-Pai,Chen, Chun-Te,Lu, Tsung-Hui,Lin, I-Long,Chang, Jesse(2013).Study on Constructing Malware Attack Forensic Procedure of Digital Evidence.2013, IEEE International Conference on System Science and Engineering,Budapest Hungary:
7. Kruse, Warren G.,Heiser, Jay G.(2001).Computer Forensics: Incident Response Essentials.Addsion- Wesley PRESS.
8. Kuchta, Kelly J.(2001).Criminal Computer Forensics Management.New York USA:AMC.
9. Marcella, Albert J., Jr.,Menendez, Doug(2008).Cyber Forensics A Field Manual for Collecting, Examining, and Preserving Evidence of Computer Crimes.AUERBACH PUBLICATIONS.
10. National Institute of Standards and Technology=NIST(2006).,National Institute of Standards and Technology=NIST.
11. U.S. Department of Justice(1999).Forensic Examination of Digital Evidence: A Guide for Law Enforcement.
12. 于朝(2002)。檢察機關數位證據蒐集與固定。中國法易網出版。
13. 吳穩男、林宜隆、張志汖(2009)。建構數字證據取證標準作業程序與有效性之研究─以智慧型手機為例。台北大學2009全國計算機研討會
14. 林一德(2000)。台灣大學法律研究所。
15. 林宜隆、朱惠中、張志汖(2008)。數位證據鑑識標準作業程序與案例驗證之建構─以Windows XP 系統為例。華梵大學2008 數位科技與創新管理研討會

1. 陳仕弘(2023)。資訊安全威脅與治理政策之探討。管理資訊計算，12(特刊1)，1-12。