복제 압수된 모바일 이미지 파일의 보관 및 폐기에 관한 연구

Abstract

The recent controversy regarding the prosecution's D-NET arises from the practice of storing all electronic information in its entirety before any filtering is done. The media is focusing on the fact that D-NET is storing information that is unrelated to criminal charges. In response, the prosecution argues that this type of storing is essential for reproducing and verifying digital evidence in court. We examined the Supreme Court's position on the legislation related to the deletion and destruction of digital evidence, as well as the practice of re-seizing electronic information from entire image files stored by investigative agencies. We conducted experiments using mobile forensic tools to empirically assess the reality of differing attitudes toward storing and the media's criticisms. The experiment is divided into three main parts. ① An experiment to assess the potential changes in mobile electronic information based on acquisition techniques. ② An experiment to determine whether the filtered images generated by a single tool are sufficient to prove the authenticity and integrity of the original evidence. ③ An experiment to determine whether reanalyzing only the filtered images is sufficient to reproduce and verify the authenticity of the original evidence. The research findings conclude that it is unavoidable to retain the entire image files. Therefore, there is a need for legislative measures to ensure their secure management. If the goal is to delete the entire image files and only retain selected ones, then technical solutions corresponding to the results of this experiment will need to be developed. However, this is expected to be realistically challenging.