Electronic data forensics rules

Electronic forensics refers to the process of obtaining, saving, analyzing and presenting evidence of computer invasion, destruction, fraud, attack and other criminal acts in a legal way by using computer software and hardware technology. From a technical point of view, computer crime forensics is a process of scanning and cracking the invaded computer system and reconstructing the intrusion event. Specifically, it refers to the computer as a crime scene, using advanced identification technology to dissect computer crimes and search criminals and their criminal evidence. Electronic data forensics includes but is not limited to:

(1) Collecting and extracting electronic data;

(2) Electronic data inspection and investigation experiments;

(3) Inspection and identification of electronic data. Electronic data collection by public security organs shall be kept confidential if it involves state secrets, police work secrets, business secrets and personal privacy; If the materials obtained have nothing to do with the case, they shall be returned or destroyed in time. Legal basis: Article 6 of the Rules for Obtaining Evidence from Electronic Data in Criminal Cases of Public Security Organs shall be collected and extracted by two or more investigators. When necessary, professional technicians can be appointed or hired to collect and extract electronic data under the auspices of investigators. Article 7 To collect and extract electronic data, one or more of the following measures and methods may be taken according to the needs of the case:

(1) Sealing up and sealing up the original storage media;

(2) Extracting electronic data on the spot;

(3) online extraction of electronic data through the network;

(4) freezing electronic data;

(5) Obtain electronic data.

Legal basis:

The evidence in Article 63 of People's Republic of China (PRC) Civil Procedure Law includes:

(a) Statements of the parties;

(2) Documentary evidence;

(3) Physical evidence;

(4) Audio-visual materials;

(5) Electronic data;

(6) Testimony of witnesses;

(7) Appraisal opinions;

(8) Records of the inquest.

Evidence must be verified before it can be used as a basis for ascertaining facts.