CC BY
83JURISPRUDENCE
GENERAL-THEORETICAL ISSUES RELATED TO DIGITAL EVIDENCE: PROBLEM AND
SOLUTION
Khamidov B.
Tashkent State Law University Criminalistics and forensic examination senior teacher of the department
Abstract
In this paper, the concepts of electronic or digital evidence are scientifically analyzed. In particular, the legal and technical features of digital evidence, issues related to their collection, storage, verification, transportation and evaluation were studied. At the same time, the problems and gaps in national legislation and law enforcement practice in dealing with digital evidence have been critically examined. Scientifically based ways and criteria for their elimination have been developed.
The article is based on scientific and practical research in the field of working with digital evidence, the views of theoretical scientists and practitioners, as well as technical research.
As a result of the research, the methodological rules of working with digital evidence were analyzed. National legislation, investigative and judicial practice, best international practices and practices are studied, their achievements and shortcomings are substantiated on the basis of the author's conclusions. Based on this, the most appropriate criteria have been developed for law enforcement entities to collect, verify and evaluate digital evidence.
The article analyzes the problems in the field from a systematic, legal, scientific and methodological point of view, on which the author's conclusions are formed. At the same time, issues related to ensuring the acceptability of digital evidence, their identification and authentication, verification and evaluation of expert opinions are also covered. Scientifically based proposals and recommendations have been developed for the legislature and its subjects.
Keywords: electronic proof, digital proof, identification, authentication, image, hash function.
The development of digital technology requires the introduction of various concepts and terms into theory and practice. In particular, in the 1990s, the terms "computer evidence" or "Internet evidence" were widely used, but today the concepts of "electronic evidence" or "digital evidence" and the question of defining their legal status are hotly debated among legal scholars.
These concepts and terms are also widely used by the legislature in the preparation and adoption of various regulations. In particular, many laws and by-laws adopted by our government include "Digital Uzbekistan", "Digital Economy", "Digital Marking" or "Electronic Digital Signature", "Electronic Public Services", "Electronic Data", "Electronic Procurement" or electronic platform ".
Unfortunately, there is no concept in the legislation that confirms exactly which term is scientifically correct and justified. In this sense, the definition of the legal status of terms related to digital technologies and the development of scientific theoretical rules can be considered as one of the systemic problems in the theory and practice of law.
The legal literature published in our country also lacks a theoretical basis for the study and regulation of electronic or digital evidence in criminal, criminal-procedural and forensic terms. The existing ones are spiritually obsolete or do not have a sufficient scientific basis. These cases create problems related to the uniform application of legal terms in legal theory and lawmak-ing activities. At the same time, it causes procedural and methodological errors by law enforcement entities.
In fact, it is expedient to give any term legal status after it has been scientifically substantiated. In this regard, the theory, unlike lawmaking, explores different views and concepts and draws scientifically based conclusions. However, such an opportunity is not always available in the preparation and adoption of normative legal documents. Therefore, it is natural that certain legal research is needed to find the optimal solution to the problem.
General views on electronic or digital evidence
There are different views among legal scholars and practitioners on the definition of "digital" or "electronic" evidence in legislation. For example, the first group of scientists consider the concept of "electronic evidence" appropriate^, p. 38; 2, 74-b; 3, 40-b; 4, 253-b; 5, p. 74]. In particular, the legal scholar O.Sh. Pirma-tov argues that electronic evidence is information created, processed, stored, and other identifiable information using information technology and information systems, as well as information that is relevant to a civil case.
At the same time, the scientist also drew attention to the concept of digital evidence. According to the scientist, digital evidence is a kind of evidence based on a binary number system that incorporates any factual information and other facts relevant to the proper resolution of an economic case that serve as a basis for a court to determine whether there are circumstances substantiating the claims and objections of the parties in economic procedural law. [6, pp. 38-39].
The scientist believed that the concept of electronic evidence is broader than digital evidence. However, O.Sh. Pirmatov's description does not fully reflect
the legal nature and significance of the digital evidence. In addition, this definition does not contain rules to ensure the integrity of digital evidence. Therefore, this definition cannot be considered complete.
According to A.N. Balashov, I.N. Balashova, D.V. Baxteev, K.L. Branovitskiy, V.V. Dolganichev, V.B. Vexov, V.N. Grigorev, A.I. Zazulin, O.A. Zaytsev, S.V. Zuev, O.A. Maksimov, M.O. Medvedeva, O.V. Ovchinnikova, D.V. Ovsyannikov, P.S. Pastukhov and O.V. Tushkanova, electronic evidence is information stored in any electronic form that can be used as evidence in court proceedings. Such types of evidence can be in the form of documents, e-mails or other files of any electronic form, as well as electronic data stored by network or Internet providers [7, pp. 253-254]. These scientists have recognized electronic evidence as one type of physical(material) evidence.
Some scholars have reacted negatively to the designation of digital evidence as an independent type of evidence in criminal proceedings. In particular, R. I. Okonenko puts forward the concept of electronic evidence in his research. According to him, it is too early to talk about the concept of "electronic evidence" as a category of positive law. Therefore, he argues that electronic evidence is not a separate type of evidence [8, p. 3].
A similar view emerges in Pastukhov's research as well. The scientist believed that it was not necessary to introduce a new type of evidence (electronic evidence) or a new source (electronic media) into the Criminal Procedure Code of the Russian Federation, but it was enough to define the concept of "evidence". He estimates that the data will be in electronic form, but that they are a type of traditional evidence [9].
If R. I. Okonenko and P.S. Pastukhov's opinions are found to be correct, then the criteria for collecting, storing, examining, and evaluating such evidence (such as material or written evidence) must be the same under procedural law. However, the digital evidence does not match the traditional evidence by any criteria. Therefore, these ideas have not been confirmed in practice.
The second group of scientists are advancing the concept of "digital evidence" [10, p. 1153; 11]. Supporters of this group are BZ Karimov, DM Topildieva, A. Yu. Cherdantsev, Sean Goodison, Robert Davis, Brian Jackson, Richard Seferstein, Yogan Kesey, Andre Arnes and others.
Sean Goodison, Robert Davis, and Bryans believe that the digital evidence is information designed to identify the causal relationships of individuals and events in time and environment. These arguments are broad-based in nature and require special training and tools in relation to specific, mobile and material evidence [12]. This definition has a common feature and can be applied to traditional types of evidence as well. Therefore, it can be assumed that the features inherent in digital evidence are not sufficiently reflected in it.
Richard Seferstein describes digital evidence as information stored through a number system (1) and (0), and extracted through guidelines (instructions) embedded in a program or code. According to him, any information in the form of a photo, text or spreadsheet can be created and stored through these instructions.
The search for and use of evidence stored in this way is a growing area of forensic science. This field is constantly changing with the development of technology [13]. The content would be correct when this definition was applied to the concept of digital information (more on this below). However, the definition did not cover features related to the acceptability and integrity of digital evidence.
Eoghan Casey believes that digital evidence or electronic evidence is any piece of evidence stored, transmitted, or transmitted in digital form that can be used by the parties to a trial. In his view, before accepting digital evidence, the court must determine its relevance (direct relevance), acceptability, and whether the submitted copy can be accepted or whether the original is required [15, p. 567].
Andre Arnes believed that digital evidence is any digital information that contains reliable information that confirms or denies the hypothesis of an event or crime [16, p. 7; 17, 152-b].
The definitions provided by Yogan Gesey and Andre Arnes do not address issues related to ensuring the integrity (hash value) of digital evidence. Therefore, it is impossible to consider these definitions as complete.
A. Yu. Cherdantsev, in his research, put forward the concept of digital (electronic) evidence. In his view, digital (electronic) evidence is information that is stored or transmitted in binary information form about the circumstances that must be determined in a criminal case in the process of collecting, examining and evaluating evidence [18, p. 57]. In our opinion, the term "digital (electronic) evidence" proposed by the scientist does not correspond to the technical characteristics of the definition given to it. However, this study did not reflect the characteristics and distinguishing features of electronic evidence. Moreover, limiting the concept of digital evidence to only the realm of criminal law confirms that it was developed in a narrow framework. The reason is that the concept of digital evidence has the same content and form for all areas of procedural law.
The definition of "digital evidence" given by researcher B. Karimov is much closer to reality. According to his view, digital evidence is important, valued information for work that is stored in a digital device and network or transmitted through them because of the human factor or cyber process [19, p. 172].
It is known that digital evidence is created and processed by a digital device. The evaluation of digital evidence (hash function) is a key condition for ensuring their integrity and reliability. However, the given definition does not specify the form of the digital evidence. From this, it can be assumed that the definition is relatively thorough and clearly developed.
The mechanism of legal regulation to ensure the integrity of digital evidence does not exist in the procedural legislation and practice of Russia and the CIS. However, in this regard, advanced foreign practices such as NIST (2006), NIJ (2001) in the USA; ASPO (2011), INTERPOL (2019), DFRWS (2008) in the UK and the legal status of digital evidence in ISO / IEC international standards or international recognized criteria to work with the digital evidence are defined [20, p. 63].
In particular, the National Institute of Standards and Technology of the United States quotes Yogan Kesey's definition of the concept of digital evidence [21, p. 1].
The National Institute of Justice (NIJ) has a separate definition of digital evidence and electronic evidence. According to this institution, digital evidence is information that can be stored or transmitted in binary form, which can be used in court [22, p. 38]. Electronic evidence is valuable information and data for investigation, which is stored or transmitted on an electronic device [23, p. 49].
The legal status of digital evidence, the rules for their collection, verification, storage, transportation and evaluation are not defined in our procedural legislation. These cases lead to violations of substantive and procedural law in law enforcement activities.
Logically, the concept of "evidence" confirms the fact that a particular action or omission that is relevant to the case actually occurred in the past. For example, when fingerprints are found at the scene, the investigator finds, takes, and records the marks left by the previous offender, but does not create or does not form the marks himself. The same rule applies when working with digital evidence. The investigator shall search, retrieve, and document the evidence left by the former offender. Therefore, the categories of "creation" and "processing" of digital information do not participate in the formation of the concept of digital evidence.
Accordingly, digital evidence is information that is stored or transmitted in digital form on a digital device or network that is of significant value to the work.
Technical feature of digital evidence
According to the laws of physics, electric current is the result of the orderly motion of electric charges [24]. In other words, electricity is a form of energy. If an electric current illuminates a lamp or starts a car engine, it makes sense to use the term "electric lamp" or "electric car" in reference to these objects. This is because electricity has a direct effect on the movement of light or matter. However, the mechanism by which digital information is generated is completely different from these processes. Therefore, an electric current or magnetic field is involved only as a source.
The smallest unit of digital information is a bit. As a rule, computer commands work with eight bits at a time, not with separate bits. Systematized eight bits are one byte, more information is kilobytes, megabytes [25, p. 53], and so on.
Most digital devices are powered by electricity. Technically, this is true. However, in terms of sources (electric current, magnetic field), the naming of information as "electronic" is relative. In fact, the source does not directly process the information, but creates the conditions for it.
Technically, any digital device has a processor. The processor receives and processes information in binary form - through the numbers "0" and "1". Depending on the nature of the information, the processor transmits digital information directly to the user via an assembler or specific copiers [26, p. 225]. In other words, through a combination of bits consisting of the numbers "0" and "1", the processor encodes the information in digital form. This information is then transmitted to the monitor in various text, photo, video, audio, graphics or other formats. For example,
Table 1
According to ISO 8859-5 standard
"Мен" The word (krill) consists of a combination of binary (8 bit) codes in the following form.
11011100 11010101 00001010 00001010
11011101
Photo of the educational building at Tashkent State Law University consists of a combination of binary
codes in the following form
..........ooooooooooooooW^
00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 11111111 00000000 00000000 00000000 00011111 10000000 11111000 00000000 00000011 11100000 00000000 00000111 11000000 01111100 00000000 00000000 00000000 00111110 10000000 00000000 11111111 11000000 00000001 11000000 00111111 11111111 11111110 00000001 11111111 11111111 11111111 11111111 11111111 00111000 01110000 11000011 10000110 00011100 00111000 00100000 11000011 00000110 00011100 00111000 01100000
II 11000011 00000110 00011100 10111000 01110000 11000011 00001110 00011101 00111000 01110000 11000011 00001110 I 00011101 00111000 01110000 11000011 00001110 00011101 01111011 01111001 11000111 00011110 0111111111111011 11111111 11111111 11111111 11111101 11111111 11111111
Rm щш л « 11111111 11111111 11111101 11111000 01110111 11011011
I 10001110 00011101 11111000 01100000 11000011 00000110 ! 00011111 00111000 01100000 1100001100000 11000011 000001
The results of the study confirm that the concept of electronic evidence is a logically erroneous concept. Accordingly, it can be assumed that electricity is only involved as a source in the processes involved in the creation, processing, storage and transmission of digital information.
How it is organized working with digital evidence
The process of working with digital evidence includes the procedural and methodological rules for collecting, verifying, storing, transporting, and evaluating them. Each of these processes is an independent stage, in which certain legal and technical requirements are followed.
The rules for working with digital evidence are equally binding for all areas of procedural law. Therefore, it is advisable that these rules be approved by a specific competent authority and brought into line with international practice and standards. The reason is that there is a need to unify the various practices formed in the field of working with digital evidence in law enforcement practice.
Digital evidence is highly impactful and rapidly changing. Therefore, special training is required when working with them. The reason is that carelessness alone is likely to damage or lose digital evidence that is valuable to the investigation. In addition,the law enforcement expert must also have the ability to independently analyze digital evidence in order to properly evaluate an opinion or expert opinion, and to determine effective investigative directions. Lack of such knowledge jeopardizes the validity of the evidence or leads to its distortion. The verdict is against the law.Ac-cordingly, it is advisable to train a special investigator, prosecutor or judge in the field.
A special investigator is a person who has undergone retraining in the field of digital forensics and has the authority to investigate a criminal case. He leads the investigation and operational team in the criminal case, and is the person fully responsible for the case. At the same time, it develops an investigation plan, forms an investigative task force on criminal cases, distributes tasks, determines the direction of the investigation, and provides general guidance on the investigation. Constantly informs the prosecutor on criminal proceedings, ensures the consistency, efficiency and legitimacy of investigative actions. It also monitors the legality of operational search activities, ensuring the acceptability of digital evidence collection, storage, verification and evaluation processes.
The peculiarity of working with digital evidence is that the value and copies of the collected evidence are sent simultaneously to the expert, prosecutor, judge and lawyer who is considering the case. This creates equal opportunities for process participants. The reason is that once the digital evidence is evaluated, they cannot be changed. Otherwise, their acceptability is compromised.
The main condition for working with digital evidence is that they are obtained with the participation of an expert. As a rule, the specialist warns team members of potential information security issues, provides initial and subsequent information about the system, network
configuration, and helps document work-related situations. Besides, he/she also provides methodological assistance to the investigator in other cases related to the case.
After that, the expert identifies digital evidence, traces and their sources; takes copies of them on the basis of technical requirements; and documents the sequence of actions performed on the digital device. He/she also analyzes and examines the digital evidence relevant to the case, draws conclusions from the research findings, and provides explanations of its findings during the investigation and trial.
It is important to ensure the security of the area when working with digital evidence. In this case, the prophylactic inspector is the first to arrive at the scene, informs the investigator about the scene, ensures that its boundaries are surrounded and that the material evidence is preserved. At the same time, it documentes the entrants to the scene (sets goals, objectives, time).
The operative-search officer ensures the execution of the instructions given by the investigator in accordance with the established procedure, strictly follows the rules of working with digital evidence and carries out the necessary operational-search measures on the case.
The involvement of the applicant or victim in the process of working with digital evidence is important. It is advisable for the investigator to begin the case by first questioning them. Through this, the current situation is clarified and the mechanism of the crime is determined. In a corporate setting, the applicant and the victim may be different individuals.
At the same time, the courts and banking specialists are involved in the process of working with digital evidence as needed.
Digital evidence is looked through using the image method [27; 28, p. 38] (visual), evaluated (hash function) and validated. Imaging digital evidence is a reliable way to ensure their integrity. The image method is a simple and a less time-consuming process. In this case, the digital evidence is visually copied and valued using special software. If this value changes, the integrity of the evidence is also compromised. The reason is that there is no possibility to restore the given value.
The benefit of image copying from digital information is that it can be returned to the owner of the original device after being copied to another device. In addition, the digital evidence is sent to the court in the prescribed manner, without excessive checks, the value of the whole. This method prevents any external influences as well as damage to the digital evidence.
Visual (image) Special digital forensic tools are needed to open and verify the information obtained by copying. For example, "Magnet Axiom" [29], "Ac-cessdate" [30], "EnCase "," EnCase FIM "," Elcomsoft "[31],"Belkasoft Evidence Center 2020",Belkasoft Acquisition and Analysis Suite, etc. These tools are also designed to work directly or remotely with digital evidence. Significant files are retrieved and displayed using digital forensic software. However, the content and integrity of your evidence or file and metadata will not change.
After reviewing the digital device and evidence, a protocol is drawn up in the prescribed manner. The
hash value of the digital evidence in the protocol shall be signed by the attesting witnesses. In this way, procedural issues related to the participation of witnesses are resolved. With the help of special programs, reports on digital information are attached to the investigation. The report will also indicate what hardware and software were used.
Once the digital devices are received, antistatic bags are filled in the prescribed manner. It is wrapped to protect against any mechanical damage and radio waves, electromagnetic influences. In this case, the USB and port channels of the digital device are closed and packed from the outside. The investigator will then take steps to transport them.
Identification of digital evidence and authentication
In criminalistical theory, identification is used to determine the authenticity of material evidence [32, p. 22]. The investigator makes extensive use of traditional forensic methods in determining the accuracy of digital evidence. However, the identification process does not allow to determine the authenticity of the evidence.
In the investigation of traditional crimes, identified objects are recorded as material evidence. In this case, the original of the material evidence relevant to the case (the subject of the crime, the weapon and the means) is removed. However, in order to ensure the acceptability of digital evidence in the virtual world, it is also necessary to confirm their authenticity.
Identification and authentication processes are independent processes that complement each other. Typically, these processes are performed simultaneously or sequentially.
Identification is the identification of a user or device through an information system or network-specific identifier. To do this, the user must enter their logo on the system or network. Username (login), numeric or alphanumeric code, nickname (nickname), telephone, passport, bank card numbers, telephone IMEI code, brand barcode, electronic signature e-mail, site address, etc. Identifiers of the person or device participates as.
Authentication is the process of verifying the authenticity of digital evidence. The data entered by the user (login, password) is checked in the system or network database. The authentication process can be one, two or many steps. The authentication of digital evidence confirms the fact that their source, the characteristics, skills, traces of the crime and other circumstances relevant to the case are in fact relevant to the offender.
The legislation of the Republic of Uzbekistan does not establish norms on the procedure for confirming the authenticity of digital evidence (hereinafter referred to as authentication). However, in the experience of advanced foreign countries, practices for the authentication of digital evidence have been formed, and international standards have been introduced in this regard [33].
How the acceptability of digital evidence is provided
Ensuring the acceptability of digital evidence is one of the systemic problems in investigative and judicial practice. Today, not only in criminal cases, but also
in civil, administrative, economic, or arbitration proceedings, there is a direct confrontation with digital evidence. The problem is that law enforcement does not have enough knowledge, skills, and abilities to work with digital evidence to make a fair decision on a case. The current legislation does not set norms on their legal status and procedural order. These circumstances have led to the formation of various practices in the field of procedural law.
According to the law, disputes related to legal issues are resolved in a procedural manner, by a court authorized on behalf of the state. It is expedient for the courts to use not only legal methods in resolving legal disputes, but also scientifically based, experienced, published in certain publications and with a high degree of reliability. The reason is that a person has no right to use any method that applies the law to find him guilty on behalf of the state. This situation does not give citizens an equal opportunity to fairly protect their rights and freedoms and legitimate interests.
In addition, the statutory requirements for the collection, storage, verification, transportation, and evaluation of digital evidence do not apply uniformly to all states. These circumstances place restrictions on the applicant in a particular jurisdiction. Therefore, technical requirements for overcoming these problems have been introduced in advanced foreign practices.
For example, in resolving international disputes over digital evidence, the courts take into account that the evidence meets not only legal but also technical requirements. Rthe validity or validity of the evidence and its compliance with the requirements of the court are examined and evaluated [34; 35; 36, 47-b; 37, 525-b; 38, 29-b].
Legal requirements include compliance with the procedural requirements for the collection, storage, verification, transportation and evaluation of digital evidence by the law enforcement officer, as well as verification of the legality, relevance, integrity, sufficiency and reliability of digital evidence relevant to the case.
The relevance of digital evidence.
Digital evidence is considered relevant only if it contains information about facts or things that confirm, refute or question the conclusions about the circumstances relevant to the criminal, civil, administrative or economic proceedings.
Adequacy of digital evidence. If all the convincing evidence of the case is gathered, which unequivocally confirms the truth of all that has to be proved and each case, their total is considered sufficient to settle the case.
Reliability of digital evidence. These are the evidences that have been found to be true as a result of the investigation [39, p. 95].
Legitimacy of digital evidence - adherence to the established procedure for the collection, storage, verification, transportation and evaluation of digital evidence in accordance with procedural law;
Integrity of digital evidence - by estimating the volume of digital evidence (algorithm) using special software.
Technical requirements refer to the procedures, tools, and methods used to collect, store, verify,
transport, and evaluate digital evidence [40]. Technical requirements vary depending on the type of digital evidence and the method and format of analysis. The law enforcer ensures the acceptability of digital evidence by complying with these two requirements.
What criteria for evaluation
of digital evidence exist
Procedural law does not specify norms for the procedure and criteria for evaluating digital evidence. At the same time, there are no clear rules and recommendations for the evaluation of digital evidence in scientific research, investigation and judicial practice in our country. However, this issue has been widely studied by foreign experts and scholars, and scientifically based investigative practices have been formed in this regard. Therefore, the most optimal solution is to fill the gaps in theory and practice, based on advanced foreign experience in this area, to prevent errors, problems and shortcomings in procedural law, investigation and judicial practice.
In assessing digital evidence, the law enforcer must first verify compliance with legal and ethical norms in their collection, storage, verification, and transportation [41]. The reason is related to the cases of analysis of personal data of citizens who are not relevant to the work when working with digital evidence. In this case, the investigator, prosecutor, court, lawyer, expert, specialist and other participants must ensure that this information is not disclosed and inviolable.
When digital evidence is examined, the expert provides scientifically sound explanations of the nature, methods, and means of the research conducted in court. In this case, the expert (specialist) should gradually document his actions, indicate the methods and means of obtaining and verifying evidence, explain in detail the evaluation criteria and evaluation issues. However, the results of the expert (expert) research must be re-presented in court. The reason is that the results of the expert examination should give the same value when checked by a judge, prosecutor, lawyer.
During the study, many developed foreign countries, particularly the United States [42, p. 498], the United Kingdom [43, p. 688], Australia [44, p. 372], and Norway [45, 366], examined expert evidence and evaluated evidence. , Advanced foreign practices such as Sweden [46, p. 227] were studied. It was found that the legislation of these countries also has strict requirements for expert research, as mentioned above.
Evaluation of evidence is the final stage of their examination. Therefore, each piece of evidence in the case must be evaluated individually and as a whole.
All features of the digital evidence are taken into account in the evaluation of the evidence. Evidence is evaluated in terms of their relevance, acceptability, reliability, and adequacy.
There are a number of views and considerations in theory on the criteria for evaluating evidence. In particular, the first group of scientists took their reliability as the main criterion in evaluating the evidence. The second group of scholars, on the other hand, considered that the content of the evaluation of evidence includes
the identification of all the features that affect the achievement of objective truth in their work [47, p. 150]. The third group of scientists considers their acceptability, reliability, relevance, and importance in evaluating digital evidence.
Evaluating digital evidence is a more complex process than material evidence. This is because there are a number of requirements that must be met even before evaluating digital evidence.
In developed countries, including the United States [48, pp. 68-69], there are initial requirements that need to be examined when evaluating digital evidence. In particular, V. Roussev proposed the following basic criteria for presenting digital evidence to the court or evaluating testimony according to the Daubert standard [49, p. 10].
1. The methods used in the investigation and examination must be theoretically based - that is, the subjects of the criminal proceedings: the investigator or expert (specialist) must use theoretically based, well-known, internationally recognized methods and tools.
2. The methods used in forensic practice should be published in law enforcement journals, newspapers or websites - so that other participants in the process, including judges and lawyers, are aware of the methods used. If the methods used are not known to the court and the parties equally, they may give a one-sided advantage and impede the principle of fairness in resolving the case.
3. Determining the degree of error of a research method involves the use of methods and tools that have been tested by international organizations and various institutions in developed countries.
4. It is considered that the methods used in practice should be accepted in a scientific society - the use of methods and tools approved by national or international scientific societies. These standards provide ample opportunity to verify the accuracy of digital evidence and the validity of expert testimony [50, p. 45]. However, they also cover the process of gathering digital evidence. Therefore, these criteria do not fully reflect the criteria for evaluating digital evidence.
In 2017, Antwi-Boasiako and Venter developed the Harmonized Model for Digital Evidence Admissibility Assessment (HM-DEAA) on the technical and legal requirements for the acceptability of digital evidence. This model outlines the following three steps in evaluating digital evidence.
a) Evaluate the acceptability of digital evidence
At this stage, the observance of procedural law and
international standards in obtaining digital evidence, as well as their importance is assessed from a forensic point of view.
b) Consideration of digital evidence
At this stage, the integrity of the digital evidence, that is, the adherence to expert procedures and tools in obtaining, storing and analyzing them, is assessed. The aim is to verify compliance with scientific principles in finding, storing and analyzing evidence, to ensure the quality of work and to strengthen confidence in the results [51].1. However, compliance with standards in the
1 SWGDE Overview of the Accreditation Process for Digital
and Multimedia Forensic Labs, 2017
handling and study of digital evidence (e.g., digital forensic tools are certified, certified for reliability and correctness, and tested before use) is also taken into account.
In addition, the standards and protocols used in laboratory research should also be studied. The purpose is to determine whether the laboratory has the ability to analyze digital evidence and provide reliable methods, digital devices and software, competent personnel, and reasoned conclusions to ensure the reliability of the results.
c) Deciding on the acceptability of digital evidence.
At this stage, the authenticity, integrity, and reliability of the digital evidence is the second stage based on the results evaluated. For example, methods and means of obtaining digital evidence are evaluated in terms of reliability and the testimony of experts is compared [52]. For the results to be valid, they must be interpreted objectively, and information about errors, inaccuracies, and limitations must be disclosed [53, p. 158; 54, p. 350; 55, p. 255].
In summary, international best practices and standards set out internationally recognized rules for the evaluation of digital evidence. Adapting them to national legislation will help to address the following issues:
first, transparency of law enforcement activities is ensured;
secondly, a science-based, objective, legal and fair mechanism for the collection, storage, verification and evaluation of digital evidence in pre-trial proceedings and in court proceedings will be introduced;
third, establish common rules not only for criminal courts but also for administrative, civil, economic and arbitration courts in the field of working with digital evidence;
fourth, provides reliable protection of the interests of the Republic of Uzbekistan in conflicts between states in the field.
Conclusion
In short, a clear definition of the rules for working with digital evidence in national legislation will allow to address errors and problems in the field of justice in a scientifically based, legal way. In this sense, the results of the study serve as a methodological basis for the unification of various practices that are formed in the system of procedural legislation.
In addition, the developed theoretical rules provide solutions to problems related to the use of legal terms in the process of preparation and adoption of normative legal documents.
I. According to the survey, the legislature:
It is advisable to use the concept of "digital evidence" in lawmaking activities. This concept is fully consistent with the legal and technical features of this evidence;
the rules for working with digital evidence are common and unchanging for all areas of procedural law. Accordingly, it is expedient to adopt the Law of the Republic of Uzbekistan "On Digital Evidence". The reason is that the acceptability of digital evidence is en-
sured not only by legal requirements, but also by technical and ethical rules. Accordingly, these rules are the same for the areas of procedural law (criminal, civil, economic procedure and administrative liability law).
II. In the process of working with digital evidence, it is advisable to ensure that the law enforcer:
retraining of law enforcement entities in the field of digital criminology (at least 1 year) (because these entities legally assess the circumstances relevant to the case. The lack of digital evidence prevents the verification and assessment of the actual state of the case);
rules for the collection, storage, verification and transportation of digital evidence in accordance with advanced foreign practices and international standards (ISO / IEC-27035-1, ISO / IEC-27035-2, ISO / IEC-27035-3, ISO / IEC-27037, ISO / IEC-27038, ISO / IEC-27040, ISO / IEC-27041, ISO / IEC-27042, ISO / IEC-27043 [56], ISO / IEC-27044, ISO / IEC-27050, ISO / IEC-30121) customization ;
approval of a code of ethics for working with digital evidence;
development and implementation of standards for digital evidence authentication;
equipping investigative and judicial bodies with modern digital forensic tools, etc.
III. It is advisable to rely on the following criteria in the assessment of digital evidence applying the law:
digital evidence is formalized in accordance with the requirements of procedural law;
adherence to the rules of ethics in dealing with digital evidence;
the use of science-based methods and tools for collecting, storing, verifying and transporting digital evidence;
ensuring the acceptability of digital evidence; the value of the numerical evidence has not changed (the possibility of achieving the same value by repeating the results).
These criteria are fully consistent with national and international standards for the evaluation of digital evidence, and aserves to decide the state.
REFERENCES:
1. Pirmatov O.Sh. Procedural aspects of electronic evidence in economic and civil proceedings. Doctor of Philosophy (PhD) dissertation in law. 2020 y. 1-155 B.
2. Kadirova M.K., Abdullaev R.K., Khujanaza-rov A.A., Rahimkulova LU Evaluation of the results of judicial computer and technical expertises by the investigators and the court. 2020. 74 S. DOI: 10.37200 / IJPR / V24I6 / PR260256. https://www.psychoso-cial.com/article/PR260256/13667/
3. Vexov V. B. Electronic criminology: understanding and system // Criminalistics: current issues of theory and practice: collection of works of participants of international scientific and practical conferences. -Rostov n / D., 2017. 44-60
4. Zuev S.V. Basic theory of electronic evidence: monograph / ed. doct. jurid. science S.V. Zueva. M., 2019. S. 253-270.
5. Abdullaev R.K. The widespread use of electronic technology in criminal proceedings. Journal of Law Research. 2020, 2 vol., Issue 5, pp. 1-255
6. Pirmatov O.Sh. Procedural aspects of electronic evidence in economic and civil proceedings // Doctor of Philosophy (PhD) dissertation in legal sciences - T .; TDYuU. 2020 y. 38 B. In the same place 38
- 39 B..
7. Basic theory of electronic evidence: monograph / ed. doct. jurid. science S.V. Zueva. - M .: Yurlit-inform, 2019. p." 253, 254.
8. Okonenko R.I. "Electronic evidence" and the problems of ensuring the rights of citizens to protect the secrets of private life in criminal proceedings: a comparative analysis of the legislation of the United States of America and the Russian Federation: dis. ... Cand. jurid. science. M., 2016
9. Pastukhov PS On the development of criminal procedural evidence using electronic evidence // ATP "ConsultantPlus".
10. Khamidov B. Kh, Karimov BZ, Topildieva DM. General Theoretical Issues of Improving Private Forensic Methods In The Field Of Combat Against Cybercrime. PSYCHOLOGY AND EDUCATION (2021) 58 (1): 2705-2712. ISSN: 00333077/2021.https://doi.org/10.17762/pae.v58i1.11 53
11. Jones, Andrew (2008). Creation of digital laboratories of criminologists. Batterworth-Xaynemann. p. 312. ISBN 978-1-85617-510-4. Digital criminology
- https://ru.qaz.wiki/wiki/Digital_forensics
12. Sean E. Goodison, Robert C. Davis, and Brian A. Jackson. Digital Evidence and the US Criminal Justice System - Identifying Technology and Other Needs to More Effectively Acquire and Utilize Digital Evidence. 2015.
13. Saferstein, Richard. A Simplified Guide To Digital Evidence. National Forensic Science Technology Center®NFSTC Largo, Florida 2015.
14. Casey, Eoghan (2004). Digital Evidence and Computer Crime, Second Edition. Elsevier. ISBN 012-163104-4.
15. Various (2009). Eoghan Casey (ed.). Handbook of Digital Forensics and Investigation. Academic Press. p. 567. ISBN 978-0-12-374267-4. Retrieved 2 September 2010.
16. Andre Arnes. Digital Forensics. Hoboken, Norway. John Wiley & Sons Ltd, 2018. - 7 p.
17. 17. Karimov Boburjon (2020). SCIENTIFIC AND THEORETICAL QUESTIONS OF DIGITAL EVIDENCE CATEGORY. Review of law sciences, 5 (Spetsvypusk), 149-153. doi: 10.24412 / 2181-919X-2020-149-153
18. Khamidov BX, Karimov BZ. Some issues in the development of the national cyber security strategy: problem and analysis. EUROPE, SCIENCE AND WE | EUROPE, VEDA A MY | EUROPE, NAUKA I MY Education and Science, Czech Republic. 2020. 63 p.
19. Karen Kent, Suzanne Chevalier, Tim Grance, Hung Dang. Guide to Integrating Forensic Techniques into Incident Response // Recommendations of the National Institute of Standards and Technology NIST Special Publication 800-86. 2006. E-1 p.
20. US Department of Justice Office of Justice Programs National Institute of Justice. Electronic Crime Scene Investigation: A Guide for First Respond-ers, Second Edition. 2001. 38 p.
21. US Department of Justice Office of Justice Programs National Institute of Justice. Electronic Crime Scene Investigation: A Guide for First Respond-ers, Second Edition. 2001. 49 p.
22. Cherdantsev A. Yu. The concept of digital evidence, the current state and their role in the evidentiary process. Legal science and practice. 2019. Vol. 15, № 4. C. 55-60. DOI: 10.25205 / 2542-0410-2019-15-455-60
23. Karimov B.Z. Scientific and theoretical issues of the category of digital evidence. Scientific article - T .: TSU Law Bulletin - Vestnik yuridicheskix nauk - Review of Law Sciences. 5 (2020) 168 B. (168-172 B.).
24. https://skachat-besplatno.info/ximfiz/237-doimi-elektr-toki-va-uning-1179onunlari. html
25. Ionova Yu.A., Kalitin S.V. The concept of evidence in electronic form and digital content: problems and perspectives. Article. Bulletin XGAEP. 2013. № 1 (63) p. 53.
26. Khamidov Bakhtiyor GENERAL THEORETICAL ISSUES OF IMPROVEMENT OF PRIVATE CRIMINALISTIC METHODOLOGIES IN THE FIELD OF COMBATING CYBER CRIME // Review of law sciences. 2020.№Spetsvypusk.URL: https ://cyberleninka. ru/article/n/obscheteoreticheskie -voprosy-sovershenstvovaniya-chastnyh-kriminal-isticheskih-metodologiy-v-sfere-borby-s-kiber-prestupnostyu (data obrashcheniya: 11.03.2021).
27. SWGDE Best Practices for Image Authentication, 2018;SWGDE Best Practices for Image Content Analysis, 2017;SWGDE Guidelines for Forensic Image Analysis, 2017. https://www.unodc.org/e4j/ru/cyber-crime/module-6/key-issues/handling-of-digital-evi-dence.html
28. Karimov BZ Using the opportunities of digital criminology in criminal cases. Monograph.- T., 2021.38 B.
29. http://www.forensicmall.ru/cat/magnet-foren-sics/magnet-axiom/
30. http://www.forensicmall.ru/cat/category/ac-cessdata/
31. http://www.forensicmall.ru/cat/cate-gory/belkasoft/
32. Criminology. Textbook. Collective cars. - T .: TGYuU. 2019. - 22 p.
33. ISO / MEK 9594-8-94 "Information technology. Interaction system. Directory. Frequency 8. Basics of authentication".
34. Biasiotti, Maria Angela, Jeanne Pia Mifsud Bonnici, Joe Cannataci (eds.) (2018). Handling and Exchanging Electronic Evidence Across Europe. Springer.
35. Kasper, Agnes and Eneli Lauritis. (2016). Challenges in Collecting Digital Evidence: A Legal Perspective. In Tanel Kerikmae and Addi Rull. The Future of Law and eTechnologies. Springer.
36. Alba, Manuel. (2014). Order out of chaos: technology, intermediation, trust, and reliability as the basis for the recognition of legal effects in electronic
transactions. Creighton Law Review, Vol. 47, 387-521.
37. Duranti, Lucciana and Corrine Rogers. (2012). Trust in digital records: an increasingly cloudy legal area.Computer Law & Security Review, Vol. 28 (5), 522-531.
38. Goode, Steven. (2009). The admissibility of electronic evidence. The Review of Litigation, Vol. 29, 1-64.
39. Criminal Procedure Code of the Republic of Uzbekistan. - T. Justice Publishing. 2020 y. Article 95
40. https://www.unodc.org/e4j/ru/cyber-crime/module-6/key-issues/digital-evidence-admissi-bility.html
41. Kizza, 2013; Seigfried-Spellar, Rogers, and Crimmins, 2017
42. Albert J. Marcella, Jr. Doug Menendez. "Cyber Forensics: A Field Manual for Collecting, Examining, and Preserving Evidence of Computer Crimes". 2nd Edition. New York, USA. Taylor & Francis Group, LLC. 2008. - 498 p.
43. Anthony TS Ho and Shujun Li. "Handbook of digital forensics of multimedia data and devices". Guildford, UK. John Wiley & Sons, Ltd., 2015. - 688p.
44. Richard Boddington. Practical Digital Forensics. Birmingham, UK. Packt Publishing Ltd., 2016. -372 p.
45. Andre Arnes. Digital Forensics. Hoboken, Norway. John Wiley & Sons Ltd, 2018. - 366 p.
46. Joakim Kävrestad. Fundamentals of Digital Forensics. Skövde, Sweden. Springer International Publishing, 2018. - 227 p.
47. Fatkullin F.N. Obshchie problem protsessual-nogo dokazo'vaniya. Kazan, 1973. S.150
48. Andre Arnes. Digital Forensics. John Wiley & Sons, Inc., 111 River Street, Hoboken, USA 2018 - pp. 68-69
49. Vassil Roussev. Digital Forensic Science: Issues, Methods, and Challenges. - Morgan & Claypool Publishers series. University of Texas, San Antonio.
2016. - p. 10
50. Goodstein, D. Reference Manual on Scienti fi c Evidence, 3rd ed., National Academies Press, 2011, ch. The Admissibility of Expert Testimony, pp. 37-54.
51. SWGDE Overview of the Accreditation Process for Digital and Multimedia Forensic Labs, 2017
52. Antwi-Boasiako and Venter, 2017; US National Institute of Justice, 2004.
53. B.X. Xamidov. Examination and evaluation of expert testimony in the investigation of cybercrime. International conference science and education / uluslarari konferans bilim ve egitim. 2021.http://doi.org/10.37057/T_1 (155-158).
54. Ибратова Ф. Б. ПРАВОВЫЕ ПРОБЛЕМЫ МИРОВОГО СОГЛАШЕНИЯ ПРИ РАССМОТРЕНИИ ДЕЛ О БАНКРОТСТВЕ В ЭКОНОМИЧЕСКИХ СУДАХ РЕСПУБЛИКИ УЗБЕКИСТАН //ПЕРСПЕКТИВЫ РАЗВИТИЯ НАУКИ В СОВРЕМЕННОМ МИРЕ. - 2019. - С. 163-170.
55. Ibratova F. Esenbekova F. GENESIS AND EVOLUTION OF LEGISLATION ON CONCEPTIONAL PROCEDURES IN THE REPUBLIC OF UZBEKISTAN. POLISH JOURNAL OF SCIENCE. №38 (2021).
56. Ibratova F. B. et al. Special features of modern legal systems: cases and collisions. - 2017.
57. Ibratova F. Problems of a settlement in bankruptcy cases in economic courts //Norwegian Journal of Development of the International Science. - 2019. - №. 28-3.
58. Ибратова Ф. Б. БАНКРОТСТВО ЛИКВИДИРУЕМОГО СУБЪЕКТА ПРЕДПРИНИМАТЕЛЬСТВА: ПРОБЛЕМЫ И РЕШЕНИЯ //Norwegian Journal of Development of the International Science. - 2021. - №. 58-2.
59. https://webstore.iec.ch/pre-view/info_isoiec27043%7Bed1.0%7Den.pdf
LEGAL ISSUES OF BANKRUPTCY OF A CITY FORMING AND RELATED ENTERPRISES
Burkhankhodzhaeva H.,
Associate Professor of the Tashkent State Law University, Ph.D.
Ibratova F.
Associate Professor of the Tashkent State Law University, Ph.D.
Abstract
The article analyzes the signs of bankruptcy, the features of the introduction of external management in relation to the city-forming and equated enterprise. It is concluded that in the process of external management of the debtor - the city-forming organization, the enterprise can be sold as the only property complex, which will allow obtaining the funds necessary for settlements with creditors without resorting to liquidating the debtor, as well as preserving jobs.
Keywords: bankruptcy, external management, city-forming and equivalent enterprises, sale of the enterprise, meeting of creditors.
A case on the bankruptcy of a city-forming enterprise and an enterprise equivalent to it may be initiated by an economic court. According to the legislation of
Uzbekistan, if a debtor is unable to satisfy creditors' claims for monetary obligations and fulfill obligations
