Encountering Encrypted Evidence (potential)

The 13th International Symposium on Space Terahertz Technology

Henry B. Wolfe

Others  :  http://proceedings.informingscience.org/IS2002Proceedings/papers/Wolfe073Encou.pdf
PID  :  27937

来源: CEUR

【 摘 要 】

Investigative activities involving computer related cases occasionally encounter files that have been en- crypted. Encryption is a valid and legal process that enables anyone to protect the privacy of his or herdata and/or communications. If the suspect is cooperative and provides not only the key but also the spe- cific encryption software, investigation is simple. However, without that cooperation, analysis of potentialevidence may not be practical or possible. This paper discusses alternatives where the suspect is not coop- erative and keys are not provided. The outcome of the investigation may as well depend on what resourcesare available to the investigator.