{"id":1772,"date":"2021-03-26T16:26:36","date_gmt":"2021-03-26T15:26:36","guid":{"rendered":"https:\/\/www.forensee.cz\/?p=1772"},"modified":"2021-05-05T16:36:08","modified_gmt":"2021-05-05T14:36:08","slug":"e-discovery-vs-digital-forensics-uskali-obou-odvetvi","status":"publish","type":"post","link":"https:\/\/www.forensee.cz\/en\/2021\/03\/26\/e-discovery-vs-digital-forensics-uskali-obou-odvetvi\/","title":{"rendered":"E\u00ad-discovery vs Digital Forensics: \u00faskal\u00ed obou odv\u011btv\u00ed"},"content":{"rendered":"<p>[et_pb_section fb_built=&#8220;1&#8243; admin_label=&#8220;section&#8220; _builder_version=&#8220;4.9.2&#8243; min_height=&#8220;1243px&#8220; height=&#8220;967px&#8220; custom_margin=&#8220;||284px|||&#8220; custom_margin_tablet=&#8220;||-85px||false|false&#8220; custom_margin_phone=&#8220;||-504px||false|false&#8220; custom_margin_last_edited=&#8220;on|tablet&#8220; custom_padding=&#8220;||123px|||&#8220;][et_pb_row admin_label=&#8220;row&#8220; _builder_version=&#8220;4.9.2&#8243; background_size=&#8220;initial&#8220; background_position=&#8220;top_left&#8220; background_repeat=&#8220;repeat&#8220; custom_margin=&#8220;-66px|auto|-401px|auto|false|false&#8220; custom_margin_tablet=&#8220;-63px||-3px||false|false&#8220; custom_margin_phone=&#8220;-63px|32px|-3px|auto|false|false&#8220; custom_margin_last_edited=&#8220;on|tablet&#8220;][et_pb_column type=&#8220;4_4&#8243; _builder_version=&#8220;3.25&#8243; custom_padding=&#8220;|||&#8220; custom_padding__hover=&#8220;|||&#8220;][et_pb_text admin_label=&#8220;Text&#8220; _builder_version=&#8220;3.27.4&#8243; background_size=&#8220;initial&#8220; background_position=&#8220;top_left&#8220; background_repeat=&#8220;repeat&#8220;]<!-- divi:paragraph --><\/p>\n<p>&nbsp;<\/p>\n<p>V na\u0161em prost\u0159ed\u00ed lze vypozorovat dv\u011b z\u00e1kladn\u00ed oblasti zkoum\u00e1n\u00ed digit\u00e1ln\u00edch dat. Zp\u0159\u00edstupn\u011bn\u00ed dat a anal\u00fdza dat. Tou prvn\u00ed je form\u00e1ln\u011b spr\u00e1vn\u00e9 ale relativn\u011b prost\u00e9 forenzn\u00ed vyhled\u00e1n\u00ed a poskytnut\u00ed dat zadavateli, tou druhou je anal\u00fdza d\u011bj\u016f a proces\u016f v prost\u0159edc\u00edch ICT. \u010cl\u00e1nek se zab\u00fdv\u00e1 \u00faskal\u00edmi obou oblast\u00ed.<\/p>\n<p>&nbsp;<\/p>\n<p><strong>Introduction<\/strong><\/p>\n<p>V\u00a0minul\u00e9m \u010d\u00edsle Digital Forensic Review (2\/2019) jsem se pustil do teoretick\u00fdch \u00favah o tom, co je p\u0159edm\u011btem digit\u00e1ln\u00ed forenzn\u00ed anal\u00fdzy, tedy o podstat\u011b digit\u00e1ln\u00ed stopy. Dosp\u011bl jsem k z\u00e1v\u011bru, \u017ee digit\u00e1ln\u00ed stopa je (nehmotn\u00e1) informace, kter\u00e1 je zaznamen\u00e1na pomoc\u00ed bin\u00e1rn\u00edho k\u00f3dov\u00e1n\u00ed. Je nez\u00e1visl\u00e1 na fyzick\u00e9 realizaci k\u00f3dov\u00e1n\u00ed, tedy je nez\u00e1visl\u00e1 na nosi\u010di digit\u00e1ln\u00ed stopy. Obecn\u011b tedy lze tvrdit, \u017ee digit\u00e1ln\u00ed stopa je latentn\u00ed a k\u00f3dovan\u00e1. Aby v\u0161ak byla digit\u00e1ln\u00ed stopa informac\u00ed podle definice, mus\u00ed tak\u00e9 b\u00fdt relevantn\u00ed k vy\u0161et\u0159ovan\u00e9 skute\u010dnosti. <br \/>Ve v\u00fd\u0161e uveden\u00e9m \u010dl\u00e1nku jsem tak\u00e9 uvedl p\u0159\u00edklad, jak a kdo posuzuje pr\u00e1v\u011b relevantnost digit\u00e1ln\u00ed stopy (Digital Forensic Review 2\/2019, str. 9\u201110). Relevantnost je toti\u017e jedn\u00edm z podstatn\u00fdch atribut\u016f informace jako takov\u00e9 obecn\u011b, a tedy i digit\u00e1ln\u00ed informace, resp. digit\u00e1ln\u00ed stopy. <br \/>Pro p\u0159ipomenut\u00ed zde zopakuji podstatnou \u010d\u00e1st uveden\u00e9ho p\u0159\u00edkladu:<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p><!-- \/divi:paragraph -->[\/et_pb_text][et_pb_image src=&#8220;https:\/\/www.forensee.cz\/wp-content\/uploads\/2021\/03\/priklad-1.png&#8220; title_text=&#8220;p\u0159\u00edklad 1&#8243; _builder_version=&#8220;4.9.2&#8243; _module_preset=&#8220;default&#8220;][\/et_pb_image][et_pb_text _builder_version=&#8220;4.9.2&#8243; _module_preset=&#8220;default&#8220;]<\/p>\n<p>Na z\u00e1klad\u011b uveden\u00e9ho p\u0159\u00edkladu se d\u00e1 vypozorovat a odvodit, \u017ee znalec vykon\u00e1val zkoum\u00e1n\u00ed ve dvou f\u00e1z\u00edch:<\/p>\n<ul>\n<li>V prvn\u00ed etap\u011b vy\u0161et\u0159ovateli (vhodnou formou) zp\u0159\u00edstupnil u\u017eivatelsk\u00e1 data \u2011 platn\u00e9 (a p\u0159\u00edpadn\u011b i smazan\u00e9 a n\u00e1sledn\u011b obnoven\u00e9) soubory \u2011 podle zadan\u00e9ho krit\u00e9ria (tady konkr\u00e9tn\u011b obrazov\u00e1 data). V\u0161imn\u011bte si, \u017ee neposuzoval to, co je na obr\u00e1zc\u00edch. Bez dal\u0161\u00edho up\u0159esn\u011bn\u00ed znalci ani nep\u0159\u00edslu\u0161\u00ed hodnotit, jestli obsah nalezen\u00fdch dat m\u00e1 nebo nem\u00e1 n\u011bjakou relevanci k vy\u0161et\u0159ovan\u00e9mu p\u0159\u00edpadu.<\/li>\n<li>Ve druh\u00e9 f\u00e1zi, kdy\u017e vy\u0161et\u0159ovatel posoudil, co z poskytnut\u00fdch dat m\u00e1 relevanci k jeho p\u0159\u00edpadu, po\u017e\u00e1dal znalce o podrobn\u00e9 prozkoum\u00e1n\u00ed dal\u0161\u00edch skute\u010dnost\u00ed (tady s c\u00edlem potvrdit nebo vyvr\u00e1tit hodnov\u011brnost p\u016fvodn\u00edch dat). Tento p\u0159\u00edklad n\u00e1zorn\u011b uk\u00e1zal, kdo a v\u016f\u010di \u010demu posuzuje relevantnost digit\u00e1ln\u00ed informace. Nicm\u00e9n\u011b m\u016f\u017ee i velice dob\u0159e poslou\u017eit k tomu, o \u010dem chci mluvit i v tomto \u010dl\u00e1nku, tedy o dvou z\u00e1kladn\u00edch oblastech \u010dinnosti, se kter\u00fdmi se v sou\u010dasnosti znalec v oblasti anal\u00fdzy digit\u00e1ln\u00edch dat setk\u00e1v\u00e1.<\/li>\n<\/ul>\n<p>Tou prvn\u00ed oblast\u00ed, stejn\u011b jako v uveden\u00e9m p\u0159\u00edklad\u011b, je oblast zp\u0159\u00edstupn\u011bn\u00ed dat, kter\u00e1 se aktu\u00e1ln\u011b vyu\u017e\u00edv\u00e1 v p\u0159e\u2011 v\u00e1\u017en\u00e9 v\u011bt\u0161in\u011b po\u017eadavk\u016f na zkoum\u00e1n\u00ed. Tou druhou oblast\u00ed je oblast anal\u00fdzy dat, kter\u00e1 je ale mnohem n\u00e1ro\u010dn\u011bj\u0161\u00ed na kvalifikaci znalce a na jeho programov\u00e9 a technick\u00e9 z\u00e1zem\u00ed. Mo\u017en\u00e1 pr\u00e1v\u011b proto (a tak\u00e9 asi i z d\u016fvod\u016f mal\u00e9ho po\u2011 v\u011bdom\u00ed o jej\u00ed mo\u017enostech) je nab\u00edzen\u00e1, a i vyu\u017e\u00edv\u00e1na mnohem m\u00e9n\u011b, ne\u017e by si zaslou\u017eila. <br \/>Ne\u017e se pokus\u00edm popsat ob\u011b zm\u00edn\u011bn\u00e9 oblasti Digital Forensic, je nutn\u00e9 p\u0159ipomenout procesy, kter\u00e9 takov\u00e9mu zkoum\u00e1n\u00ed p\u0159edch\u00e1zej\u00ed, abychom m\u011bli z\u00e1kladn\u00ed v\u00fdchodiskovou situaci. Obecn\u011b lze \u0159\u00edct, \u017ee spole\u010dn\u00fdm v\u00fdchodiskem by m\u011blo b\u00fdt korektn\u00ed forenzn\u00ed zaji\u0161t\u011bn\u00ed dat. Obecn\u011b tak\u00e9 lze \u0159\u00edct, \u017ee by to m\u011bly b\u00fdt forenzn\u00ed obrazy datov\u00fdch nosi\u010d\u016f nebo jejich \u010d\u00e1st\u00ed, opat\u0159en\u00e9 kontroln\u00edmi sumami (jak je to uvedeno nap\u0159. v DFR 2\/2018, str. 12). <br \/>Jestli\u017ee vyjdu z toho, \u017ee forenzn\u011b zaji\u0161t\u011bn\u00e1 data nejsou p\u0159\u00edmo (bez dal\u0161\u00edho specifick\u00e9ho technick\u00e9ho a zejm\u00e9na programov\u00e9ho vybaven\u00ed) u\u017eivatelsky \u010diteln\u00e1, tedy pro koncov\u00e9ho u\u017eivatele (nap\u0159. vy\u0161et\u0159ovatele P\u010cR) jsou po\u0159\u00e1d latentn\u00ed a k\u00f3dovan\u00e1, mus\u00ed nastoupit odborn\u00e1 pr\u00e1ce, kter\u00e1 tato data koncov\u00e9mu u\u017eivateli vhodn\u00fdm zp\u016fsobem zp\u0159\u00edstupn\u00ed. <br \/>Jak bylo uvedeno v\u00fd\u0161e, forenzn\u00ed kopie\/obraz digit\u00e1ln\u00edch dat je prov\u00e1d\u011bna standardn\u011b ve form\u011b forenzn\u00edho obrazu datov\u00e9ho nosi\u010de (bl\u00ed\u017ee viz. nap\u0159. DFR 2\/2019, str. 11). Pro zp\u0159\u00edstupn\u011bn\u00ed dat u\u017eivateli je nutn\u00e9 datovou strukturu forenzn\u00edho obrazu analyzovat, dek\u00f3dovat, zjistit, zda a jak byl p\u016fvodn\u00ed disk rozd\u011blen a odd\u00edly, jak\u00e9 souborov\u00e9 syst\u00e9my jsou v jednotliv\u00fdch odd\u00edlech disku pou\u017eity, a nakonec aplikovat pravidla dan\u00e9ho souborov\u00e9ho syst\u00e9mu na data dan\u00e9ho odd\u00edlu disku, aby bylo mo\u017en\u00e9 identifikovat jednotliv\u00e9 soubory. A\u017e pot\u00e9 je mo\u017en\u00e9 z\u00edskat k nim p\u0159\u00edstup a podle pot\u0159eby u\u017eivatele je ve vhodn\u00e9 form\u011b zp\u0159\u00edstupnit.<\/p>\n<p><strong>\u00a0<\/strong><\/p>\n<p><strong>Zp\u0159\u00edstupn\u011bn\u00ed digit\u00e1ln\u00edch dat <\/strong><\/p>\n<p>Po forenzn\u00edm zaji\u0161t\u011bn\u00ed digit\u00e1ln\u00edch dat a jejich dek\u00f3dov\u00e1n\u00ed a zviditeln\u011bn\u00ed lze p\u0159istoupit k vyhled\u00e1n\u00ed relevantn\u00edch soubor\u016f podle po\u017eadavku u\u017eivatele. Nej\u010dast\u011bji to b\u00fdv\u00e1 po\u017eadavek na v\u00fdb\u011br soubor\u016f, kter\u00e9 obsahuj\u00ed n\u011bjak\u00fd relevantn\u00ed text (nap\u0159. jm\u00e9na osob nebo firem), \u010d\u00edslo (suma, I\u010cO, telefonn\u00ed \u010d\u00edslo), e\u2011mailovou adresu nebo cokoliv dal\u0161\u00edho. D\u00e1le to pak m\u016f\u017ee b\u00fdt po\u017eadavek na ur\u010dit\u00fd typ soubor\u016f (jako ve v\u00fd\u0161e uveden\u00e9m p\u0159\u00edkladu fotografie, tedy obrazov\u00e9 soubory), dokumenty (a vznik\u00e1 ot\u00e1zka, jak\u00fd form\u00e1t dat odpov\u00edd\u00e1 v po\u010d\u00edta\u010di pojmu \u201edokument\u201c), tabulky, v\u0161echny soubory vytvo\u0159en\u00e9 (ur\u010dit\u00fdm) u\u017eivatelem, soubory vytvo\u0159en\u00e9 nebo upravovan\u00e9 v ur\u010dit\u00e9m \u010dase nebo \u010dasov\u00e9m \u00faseku, data komunikace ur\u010dit\u00e9 osoby nebo osob nebo komunikace v dan\u00e9m \u010dasov\u00e9m obdob\u00ed nebo n\u011bjak\u00e9 podobn\u00e9 krit\u00e9rium. A t\u011bch m\u016f\u017ee b\u00fdt nep\u0159ebern\u00e9 mno\u017estv\u00ed. <br \/>Co je ale na tomto p\u0159\u00edstupu podstatn\u00e9? Jedn\u00e1 se v\u017edy o identifikaci a nalezen\u00ed dat podle n\u011bjak\u00fdch (v\u011bt\u0161inou) vn\u011bj\u0161\u00edch charakteristik soubor\u016f nebo z\u00e1znam\u016f. V z\u00e1sad\u011b se tedy nejedn\u00e1 o n\u011bjakou jejich anal\u00fdzu a zejm\u00e9na se nejedn\u00e1 o anal\u00fdzu obsahu takov\u00fdch soubor\u016f (jestli\u017ee pod pojmem \u201eanal\u00fdza\u201c nech\u00e1peme jejich vyhled\u00e1n\u00ed\/identifikaci podle zadan\u00fdch krit\u00e9ri\u00ed).<br \/>Zp\u0159\u00edstupn\u011bn\u00ed dat u\u017eivateli ale \u010dasto nen\u00ed tak trivi\u00e1ln\u00ed probl\u00e9m, jak by to mohlo z p\u0159edchoz\u00edho vypadat. Pokus\u00edm se zm\u00ednit n\u011bkolik asi nejtypi\u010dt\u011bj\u0161\u00edch probl\u00e9m\u016f, se kter\u00fdmi je mo\u017en\u00e9 se potkat p\u0159i \u0159e\u0161en\u00ed po\u017eadavku na zp\u0159\u00edstupn\u011bn\u00ed dat. Mus\u00edm tak\u00e9 dodat, \u017ee tyto probl\u00e9my vznikaj\u00ed nejenom na technick\u00e9 \u00farovni nebo na \u00farovni profesion\u00e1ln\u00edch limit\u016f znalce, ale asi nej\u010dast\u011bji z d\u016fvod\u016f nevhodn\u00e9 formulace krit\u00e9ri\u00ed, podle kter\u00fdch je po\u017eadov\u00e1no data vyhledat a zp\u0159\u00edstupnit.<\/p>\n<ul>\n<li>Probl\u00e9m vznik\u00e1 \u010dasto ve formulaci po\u017eadavku na v\u00fdb\u011br dat. Typick\u00fdm p\u0159\u00edkladem je po\u017eadavek typu \u201ezp\u0159\u00edstupn\u011bte v\u0161echny soubory, kter\u00e9 maj\u00ed charakter smlouvy firmy XYZ\u201c. Je na znalci, aby zadavatele v\u010das upozornil, \u017ee po\u017eadavek nelze splnit. P\u0159i poskytnut\u00ed dat se jednak neanalyzuje samotn\u00fd obsah, ale zejm\u00e9na po\u017eadavek m\u00e1 ve sv\u00e9 podstat\u011b pr\u00e1vn\u00ed charakter a znalci nep\u0159\u00edslu\u0161\u00ed takov\u00e9 zkoum\u00e1n\u00ed prov\u00e1d\u011bt. Posouzen\u00ed toho, zda obsah dan\u00e9ho dokumentu\/souboru m\u00e1 nebo nem\u00e1 charakter smlouvy p\u0159esahuje kompetence znalce.<\/li>\n<li>Dal\u0161\u00edm \u010dast\u00fdm probl\u00e9mem je nejednozna\u010dn\u00e1 specifikace po\u017eadavku typu \u201ezp\u0159\u00edstupn\u011bte v\u0161echny textov\u00e9 dokumenty&#8230;\u201c. Z pohledu zadavatele to lze sice pochopit, nicm\u00e9n\u011b pro realizaci takov\u00e9ho po\u017eadavku je nutn\u00e9 up\u0159esnit, co zadavatel pod pojmem \u201etextov\u00fd dokument\u201c ch\u00e1pe (jak jsem uvedl v\u00fd\u0161e, up\u0159esnit, co to pojem \u201edokument\u201c v po\u010d\u00edta\u010di znamen\u00e1). Zda skute\u010dn\u011b pouze dokumenty vytvo\u0159en\u00e9 v textov\u00e9m editoru (tedy typicky v\u0161echny soubory s p\u0159\u00edponou .DOC a .DOCX, by\u0165 je nutn\u00e9 vz\u00edt do \u00favahy i dokumenty vytvo\u0159en\u00e9 v jin\u00fdch textov\u00fdch procesorech, ne\u017e jen MS Office) a potvrdit si, jestli zahrnout i jin\u00e9 potenci\u00e1ln\u00ed zdroje, jako jsou soubory plaintextov\u00e9 (tedy standardn\u011b s p\u0159\u00edponou .TXT), ale i jin\u00e9, nap\u0159. RTF, PDF. Pro ilustraci, jak takov\u00fd zd\u00e1nliv\u011b jednoduch\u00fd (a z pohledu zadavatele dokonce snad i trivi\u00e1ln\u00ed) \u00fakol m\u016f\u017ee b\u00fdt komplikovan\u00fd, uv\u00e1d\u00edm odkaz na v\u00fd\u010det typ\u016f soubor\u016f, kter\u00e9 lze za\u0159adit do kategorie textov\u00fdch dokument\u016f \u2011 hKps:\/\/fileinfo.com\/filetypes\/ text. Nepo\u010d\u00edtal jsem je, ale odhadem je takov\u00fdch form\u00e1t\u016f soubor\u016f na t\u00e9to str\u00e1nce definov\u00e1no kolem 500. By\u0165 mnoho z nich je velice z\u0159\u00eddka pou\u017eit\u00fdch v b\u011b\u017en\u00e9m \u017eivot\u011b v na\u0161em prost\u0159ed\u00ed, obecn\u011b by teoreticky znalec m\u011bl posoudit v\u0161echny potenci\u00e1ln\u011b pou\u017eiteln\u00e9 form\u00e1ty soubor\u016f, kter\u00e9 mohou obsahovat textovou informaci. A asi nemus\u00edm zd\u016fraz\u0148ovat, \u017ee podobn\u00e1 situace je i p\u0159i po\u017eadavku na zp\u0159\u00edstupn\u011bn\u00ed jin\u00fdch typ\u016f soubor\u016f. Nap\u0159. jak jsem uv\u00e1d\u011bl v\u00fd\u0161e v p\u0159\u00edkladu, kdy bylo pot\u0159ebn\u00e9 identifikovat obrazov\u00e9 soubory, tak u t\u011bch je nejd\u0159\u00edve pot\u0159ebn\u00e9 specifikovat o jak\u00e9 obr\u00e1zky se jedn\u00e1, zda jen rastrov\u00e9, nebo i vektorov\u00e9 a 3D, zda do toho zahrnout i video a dal\u0161\u00ed, ale nap\u0159. obr\u00e1zky mohou b\u00fdt ulo\u017eeny i v jin\u00fdch form\u00e1tech, nap\u0159. naskenovan\u00e9 dokumenty, vlo\u017een\u00e9 obr\u00e1zky v textov\u00fdch dokumentech a pod. Je vid\u011bt, \u017ee zd\u00e1nliv\u011b trivi\u00e1ln\u00ed po\u017eadavek m\u016f\u017ee v\u00e9st na stran\u011b znalce ke slo\u017eit\u00fdm, \u010dasov\u011b i technologicky n\u00e1ro\u010dn\u00fdm a mnohdy i technicky t\u00e9m\u011b\u0159 nerealizovateln\u00fdm \u00fakol\u016fm.<\/li>\n<li>P\u0159i po\u017eadavku (nap\u0159\u00edklad) na zp\u0159\u00edstupn\u011bn\u00ed \u201ev\u0161ech textov\u00fdch dokument\u016f\u201c vznik\u00e1 z\u00e1sadn\u00ed probl\u00e9m pr\u00e1v\u011b ve v\u00fdb\u011bru vhodn\u00e9ho zp\u016fsobu (metody) toho, jak technicky po\u017eadovan\u00e9 textov\u00e9 dokumenty identifikovat. Z jedn\u00e9 strany se lze domn\u00edvat, \u017ee zadavatelova p\u0159edstava (kter\u00e1 nejsp\u00ed\u0161e vych\u00e1z\u00ed z jeho osobn\u00edch u\u017eivatelsk\u00fdch zku\u0161enost\u00ed z pr\u00e1ce s po\u010d\u00edta\u010dem) je limitov\u00e1na na textov\u00e9 dokumenty MS Office. P\u0159i neznalosti po\u010d\u00edta\u010dov\u00e9 gramotnosti vy\u0161et\u0159ovan\u00e9 osoby je v\u00fdb\u011br odpov\u00eddaj\u00edc\u00ed metody identifikace textov\u00fdch dokument\u016f \u00faloha t\u00e9m\u011b\u0159 nerealizovateln\u00e1. Z druh\u00e9 strany p\u0159i tak velk\u00e9m po\u010dtu textov\u00fdch form\u00e1t\u016f nelze prakticky realizovat postup, kter\u00fd by je spolehliv\u011b identifikoval v\u0161echny. P\u0159i zkoum\u00e1n\u00ed je proto nutn\u00e9 v\u017edy p\u0159istoupit k ur\u010dit\u00e9mu kompromisu. Z pohledu znalce je ale ka\u017ed\u00e9 kompromisn\u00ed \u0159e\u0161en\u00ed potenci\u00e1ln\u011b problematick\u00e9 a vn\u00e1\u0161\u00ed do v\u00fdsledku ur\u010ditou m\u00edru neur\u010ditosti, kter\u00e1 se pak potenci\u00e1ln\u011b \u0161patn\u011b obhajuje p\u0159i pod\u00e1n\u00ed vysv\u011btlen\u00ed u soudu. Z pohledu zadavatele (jestli\u017ee mu znalec celou problematiku zvolen\u00e9ho kompromisu ve v\u00fdb\u011bru metody zkoum\u00e1n\u00ed pat\u0159i\u010dn\u011b v posudku objasn\u00ed) zp\u016fsobuje kompromisn\u00ed \u0159e\u0161en\u00ed potenci\u00e1ln\u00ed probl\u00e9m ve sn\u00ed\u017een\u00ed d\u016fkazn\u00ed s\u00edly takov\u00e9ho znaleck\u00e9ho posudku.\n<p>V\u00fd\u0161e uveden\u00e9 p\u0159\u00edklady jsou v\u011bnov\u00e1ny probl\u00e9m\u016fm spojen\u00fdm s identifikac\u00ed digit\u00e1ln\u00edch dat podle po\u017eadavku zadavatele. Nicm\u00e9n\u011b mnohdy nem\u00e9n\u011b slo\u017eit\u011bj\u0161\u00ed probl\u00e9m vznik\u00e1 i p\u0159i realizaci po\u017eadavku, kter\u00fd vych\u00e1z\u00ed ze slov\u00ed\u010dka\/po\u017eadavku \u201ezp\u0159\u00edstupnit\u201c. Logicky se nab\u00edz\u00ed ot\u00e1zka \u201ejak?\u201c. V z\u00e1sad\u011b existuj\u00ed dv\u011b z\u00e1kladn\u00ed mo\u017enosti:<\/li>\n<li>V origin\u00e1ln\u00ed podob\u011b. V tomto p\u0159\u00edpad\u011b jsou data po identifikaci podle po\u017eadavku zadavatele vykop\u00edrov\u00e1na na extern\u00ed nosi\u010d v jejich origin\u00e1ln\u00edm form\u00e1tu, tedy tak, aby co nejp\u0159esn\u011bj\u0161\u00edm zp\u016fsobem odpov\u00eddala p\u016fvodn\u00edmu tvaru a obsahu a zachovala si tak maxim\u00e1ln\u00ed d\u016fkazn\u00ed silu. Teoreticky spr\u00e1vn\u00e9 a optim\u00e1ln\u00ed \u0159e\u0161en\u00ed, av\u0161ak prakticky v mnoha p\u0159\u00edpadech neakceptovateln\u00e9. Zadavatel toti\u017e mus\u00ed b\u00fdt schopen takto poskytnut\u00fdm v\u00fdstup\u016fm porozum\u011bt, jinak \u0159e\u010deno takov\u00fd v\u00fdstup, aby byl pro n\u011bj pou\u017eiteln\u00fd, mus\u00ed b\u00fdt pro n\u011bj taky \u010diteln\u00fd. Jestli\u017ee je ale p\u016fvodn\u00ed form\u00e1t nalezen\u00fdch dat pro zadavatele ne\u010diteln\u00fd, je pro n\u011bj takov\u00fd v\u00fdstup nepou\u017eiteln\u00fd (jenom jako p\u0159\u00edklad lze uv\u00e9st nap\u0159. textovou dokumentaci k n\u011bjak\u00e9mu projektu, kter\u00e1 je ve vektorov\u00e9m form\u00e1tu .DWG, kter\u00fd ur\u010dit\u011b nen\u00ed b\u011b\u017en\u00fdmi prost\u0159edky pro u\u017eivatele \u010diteln\u00fd). <br \/>\u2022 V transformovan\u00e9 podob\u011b. V tomto p\u0159\u00edpad\u011b se data, kter\u00e1 byla podle po\u017eadavku zadavatele identifikov\u00e1na, poskytnou zadavateli v transformovan\u00e9 podob\u011b tak, aby byla pro zadavatele \u010diteln\u00e1, a tedy i p\u0159\u00edmo pou\u017eiteln\u00e1. Prakticky to znamen\u00e1 p\u0159edpokl\u00e1dat nap\u0159\u00edklad, \u017ee zadavatelovo po\u010d\u00edta\u010dov\u00e9 vybaven\u00ed umo\u017e\u0148uje spl\u0148ovat ur\u010dit\u00fd standard, nap\u0159. \u017ee je schopen \u010d\u00edst form\u00e1ty dat MS Office (tedy minim\u00e1ln\u011b Word, Excel a Powerpoint) a form\u00e1t PDF. Na z\u00e1klad\u011b takov\u00e9ho p\u0159edpokladu by bylo nutn\u00e9 transformovat ve\u0161ker\u00e9 n\u00e1lezy do form\u00e1t\u016f, kter\u00e9 jsou pro ur\u010dit\u00e9 \u201estandardizovan\u00e9\u201c vybaven\u00ed zadavatele \u010diteln\u00e9\/zobraziteln\u00e9. Toto \u0159e\u0161en\u00ed ale nar\u00e1\u017e\u00ed na n\u011bkolik probl\u00e9m\u016f, kter\u00fdmi jsou (krom\u011b jin\u00fdch) nap\u0159. samotn\u00e1 existence konverzn\u00edch program\u016f mezi jednotliv\u00fdmi form\u00e1ty dat, probl\u00e9m p\u0159esnosti takov\u00fdch konverz\u00ed, neexistence p\u0159esn\u00fdch ve\u0159ejn\u00fdch definic jednotliv\u00fdch datov\u00fdch form\u00e1t\u016f (typicky pro form\u00e1ty nej\u010dast\u011bji se vyskytuj\u00edc\u00edch dat spole\u010dnosti Microsoft), a t\u00edm problematick\u00e9 p\u0159esnosti jejich konverz\u00ed, problematika korektn\u00edho p\u0159evodu text\u016f v r\u016fzn\u00fdch zp\u016fsobech k\u00f3dov\u00e1n\u00ed jazyk\u016f mezi form\u00e1ty dat apod. Pravd\u011bpodobn\u011b ale asi nejz\u00e1va\u017en\u011bj\u0161\u00edm probl\u00e9mem p\u0159i \u0159e\u0161en\u00ed konverz\u00ed jsou objemy dat, kter\u00e9 by bylo nutn\u00e9 transformovat. P\u0159i r\u016fznorodosti form\u00e1t\u016f a potenci\u00e1ln\u011b velk\u00e9m mno\u017estv\u00ed jejich verz\u00ed a dal\u0161\u00edch r\u016fzn\u00fdch specifik je jen st\u011b\u017e\u00ed mo\u017en\u00e9 \u00falohu konverz\u00ed mezi form\u00e1ty dat automatizovat. A to nemluv\u00edm o skute\u010dnosti, \u017ee obecn\u011b plat\u00ed, \u017ee ka\u017edou transformac\u00ed jsou origin\u00e1ln\u00ed data degradov\u00e1na, tedy prakticky ka\u017ed\u00e1 transformace dat mezi form\u00e1ty je ztr\u00e1tov\u00e1 a p\u016fvodn\u00ed data t\u00edm potenci\u00e1ln\u011b ztr\u00e1cej\u00ed svoji d\u016fkazn\u00ed s\u00edlu. Jenom jako posledn\u00ed pozn\u00e1mku k tomuto lze uv\u00e9st, \u017ee asi tou nejhor\u0161\u00ed variantou transformace (z pohledu degradace p\u016fvodn\u00edch dat, a i \u010dasov\u00e9 n\u00e1ro\u010dnosti) je transformace digit\u00e1ln\u00edch dat do tiskov\u00e9 podoby \u2011 tedy tisk dat, by\u0165 p\u0159evod digit\u00e1ln\u00edch d\u016fkaz\u016f na listinn\u00e9 se jev\u00ed z pohledu mnoha zadavatel\u016f a u\u017eivatel\u016f v\u00fdstupu znaleck\u00e9ho posudku jako administrativn\u011b nejoptim\u00e1ln\u011bj\u0161\u00ed.<\/li>\n<\/ul>\n<p>Z v\u00fd\u0161e uveden\u00fdch p\u0159\u00edklad\u016f je z\u0159ejm\u00e9, \u017ee r\u016fzn\u00fdch typ\u016f a form\u00e1t\u016f dat je v po\u010d\u00edta\u010d\u00edch potenci\u00e1ln\u011b nep\u0159ebern\u00e9 mno\u017estv\u00ed. Je na odbornosti a zku\u0161enosti znalce a na programov\u00fdch a technick\u00fdch prost\u0159edc\u00edch, kter\u00fdmi disponuje, jak v\u016fbec a jak efektivn\u011b je schopen identifikovat relevantn\u00ed data podle krit\u00e9ri\u00ed zadavatele a v jak\u00e9 form\u011b je schopen je zadavateli poskytnout. P\u0159i potenci\u00e1ln\u011b velk\u00fdch po\u010dtech a objemech v\u00fdsledk\u016f je to \u00faloha ur\u010dit\u011b netrivi\u00e1ln\u00ed. <br \/>Spole\u010dn\u00fdm jmenovatelem pro \u00falohy typu \u201ezp\u0159\u00edstupn\u011bn\u00ed dat\u201c podle zadan\u00fdch krit\u00e9ri\u00ed je v\u0161ak skute\u010dnost, \u017ee znalec nehodnot\u00ed obsah nalezen\u00fdch dat, neprov\u00e1d\u00ed jeho anal\u00fdzu. Jedin\u00fdm \u00fakolem znalce je po technick\u00e9 str\u00e1nce posoudit, zda data odpov\u00eddaj\u00ed krit\u00e9ri\u00edm, kter\u00e1 dostal jako zad\u00e1n\u00ed od zadavatele.<\/p>\n<p><strong>Anal\u00fdza digit\u00e1ln\u00edch dat<\/strong><\/p>\n<p>Druhou oblast\u00ed znaleck\u00e9ho zkoum\u00e1n\u00ed je anal\u00fdza digit\u00e1ln\u00edch dat. Jak vypl\u00fdv\u00e1 z p\u0159\u00edkladu v \u00favodu tohoto \u010dl\u00e1nku, v t\u00e9to oblasti prob\u00edh\u00e1 anal\u00fdza samotn\u00e9ho obsahu dat. Je ov\u0161em nutn\u00e9 si uv\u011bdomit, v\u016f\u010di \u010demu se relevantnost analyzovan\u00fdch dat posuzuje. Jestli\u017ee zadavatel posuzuje relevantnost obsahu (v tomto p\u0159\u00edpad\u011b obr\u00e1zk\u016f) v\u016f\u010di vy\u0161et\u0159ovan\u00fdm skute\u010dnostem, anal\u00fdza dat (obsahu soubor\u016f) je v na\u0161em p\u0159\u00edklad\u011b posuzov\u00e1na znalcem v\u016f\u010di pravdivosti EXIF informac\u00ed obr\u00e1zk\u016f k technick\u00fdm parametr\u016fm sn\u00edmac\u00edho \u010dipu dan\u00e9ho digit\u00e1ln\u00edho fotoapar\u00e1tu.<\/p>\n<p>Mo\u017en\u00e1 nen\u00ed v\u00fd\u0161e uveden\u00fd p\u0159\u00edklad dostate\u010dn\u011b n\u00e1zorn\u00fdm, proto se pokus\u00edm uv\u00e9st dal\u0161\u00ed p\u0159\u00edklady, kdy je pot\u0159ebn\u00e9 analyzovat obsah dat s c\u00edlem zji\u0161t\u011bn\u00ed po\u017eadovan\u00fdch informac\u00ed. <br \/>\u2022 \u201eZjist\u011bte, kdy byl po\u010d\u00edta\u010d naposled zapnut a k\u00fdm, jak\u00e9 aktivity byly na n\u011bm prov\u00e1d\u011bny a kdy byl vypnut\u201c \u2011 i tak by se dala formulovat pom\u011brn\u011b \u010dast\u00e1 ot\u00e1zka, se kterou se mohou znalci setkat. V tomto p\u0159\u00edpad\u011b je pravd\u011bpodobn\u011b nutn\u00e9 identifikovat v\u011bt\u0161\u00ed mno\u017estv\u00ed soubor\u016f, kter\u00e9 by mohly potenci\u00e1ln\u011b obsahovat informace o chodu syst\u00e9mu. Analyzovat pou\u017eit\u00fd opera\u010dn\u00ed a souborov\u00fd syst\u00e9m, zjistit, kde se daj\u00ed v dan\u00e9m syst\u00e9mu nal\u00e9zt relevantn\u00ed informace a posl\u00e9ze analyzovat nap\u0159. obsah informac\u00ed v syst\u00e9mov\u00fdch souborech MS Windows a v registrech, informac\u00ed z metadat souborov\u00e9ho syst\u00e9mu, zji\u0161\u0165ovat relevantn\u00ed informace z dal\u0161\u00edch vhodn\u00fdch zdroj\u016f, normalizovat a korelovat v\u0161echna takto z\u00edskan\u00e1 data a vyvodit z nich relevantn\u00ed z\u00e1v\u011bry. Z p\u0159\u00edkladu je vid\u011bt, \u017ee doch\u00e1z\u00ed k anal\u00fdze obsahu r\u016fzn\u00fdch datov\u00fdch zdroj\u016f a jejich hodnocen\u00ed ve vztahu k zadan\u00e9mu po\u017eadavku.<\/p>\n<ul>\n<li>\u201ePotvr\u010fte nebo vyvra\u0165te tvrzen\u00ed, \u017ee dan\u00e1 data byla do po\u010d\u00edta\u010de nahran\u00e1 bez v\u011bdom\u00ed u\u017eivatele\u201c. Je to typick\u00fd p\u0159\u00edklad, kdy data, nalezen\u00e1 v pr\u016fb\u011bhu zp\u0159\u00edstupn\u011bn\u00ed dat, je pot\u0159ebn\u00e9 verifikovat a analyzovat jejich v\u011brohodnost. Prozkoumat, zda na dan\u00e9 technice existuje mo\u017enost ovl\u00e1d\u00e1n\u00ed za\u0159\u00edzen\u00ed zven\u010d\u00ed a\u0165 u\u017e n\u011bjak\u00fdmi standardn\u00edmi prost\u0159edky nebo zda byl po\u010d\u00edta\u010d infikov\u00e1n n\u011bjak\u00fdm \u0161kodliv\u00fdm programem a ov\u011b\u0159it vlastnosti takov\u00e9ho \u0161kodliv\u00e9ho programu poskytnout vzd\u00e1len\u00e9mu u\u017eivateli p\u0159\u00edstup k za\u0159\u00edzen\u00ed v takov\u00e9m rozsahu, kter\u00fd by umo\u017e\u0148oval nahr\u00e1t na za\u0159\u00edzen\u00ed p\u0159edm\u011btn\u00e1 data. P\u0159\u00edpadn\u011b prok\u00e1zat, \u017ee k takov\u00e9 ud\u00e1losti do\u0161lo a kdy, pokusit se identifikovat extern\u00ed zdroj takov\u00fdch aktivit a dal\u0161\u00ed skute\u010dnosti, kter\u00e9 by uveden\u00e9 aktivity potvrzovaly.<\/li>\n<\/ul>\n<p>Co je vid\u011bt z obou v\u00fd\u0161e uveden\u00fdch p\u0159\u00edklad\u016f (z obou oblast\u00ed pr\u00e1ce znalce) na prvn\u00ed pohled je skute\u010dnost, \u017ee v prvn\u00ed oblasti je zji\u0161\u0165ov\u00e1no to, co je v po\u010d\u00edta\u010di, kde\u017eto v druh\u00e9 oblasti je zji\u0161\u0165ov\u00e1no to, co se v po\u010d\u00edta\u010di ud\u00e1lo. D\u00e1 se z toho tak\u00e9 dovodit, \u017ee po\u017eadavky na pr\u00e1ci v obou oblastech se z\u0159ejm\u011b li\u0161\u00ed jak z pohledu n\u00e1rok\u016f na technologick\u00e9 vybaven\u00ed znaleck\u00e9 laborato\u0159e, tak z pohledu po\u017eadavk\u016f na kvalifika\u010dn\u00ed p\u0159edpoklady znalce. A v\u016fbec nechci tady hodnotit, kter\u00e1 z uveden\u00fdch oblast\u00ed je v\u00edce nebo m\u00e9n\u011b n\u00e1ro\u010dn\u00e1. Nicm\u00e9n\u011b je nutn\u00e9 zm\u00ednit, \u017ee ot\u00e1zka vyhled\u00e1n\u00ed dat (resp. soubor\u016f) podle zadan\u00fdch krit\u00e9ri\u00ed je mnohem l\u00e9pe algoritmizovateln\u00e1 a t\u00edm i l\u00e9pe pokryt\u00e1 r\u016fzn\u00fdmi SW n\u00e1stroji pro forenzn\u00ed anal\u00fdzu ne\u017e oblast anal\u00fdzy digit\u00e1ln\u00edch dat. Ta vy\u017eaduje detailn\u00ed v\u011bdomosti pr\u00e1ce opera\u010dn\u00edch a souborov\u00fdch syst\u00e9m\u016f tak, aby byl znalec schopen identifikovat a dolo\u017eit souvislosti v datech z r\u016fzn\u00fdch oblast\u00ed syst\u00e9m\u016f a vyvodit z nich relevantn\u00ed z\u00e1v\u011bry. To jsou pr\u00e1v\u011b oblasti, kde se projevuje velmi velk\u00e1 variabilita vstupn\u00edch dat a kter\u00e9 se jen st\u011b\u017e\u00ed daj\u00ed nahradit r\u016fzn\u00fdmi programov\u00fdmi n\u00e1stroji. Je tedy v mnohem v\u011bt\u0161\u00ed m\u00ed\u0159e vy\u017eadov\u00e1na znalcova znalost dan\u00e9ho prost\u0159ed\u00ed mnohdy r\u016fzn\u00fdch informa\u010dn\u00edch syst\u00e9m\u016f. <br \/>Vznik\u00e1 ale vz\u00e1p\u011bt\u00ed ot\u00e1zka, jestli je takov\u00e9 \u010dlen\u011bn\u00ed v\u016fbec d\u016fle\u017eit\u00e9 a jak\u00fd to v podstat\u011b m\u00e1 v\u00fdznam pro znaleckou pr\u00e1ci a pro pochopen\u00ed mo\u017enost\u00ed znaleck\u00e9ho zkoum\u00e1n\u00ed ze strany potenci\u00e1ln\u00ed klientely (prim\u00e1rn\u011b od O\u010cT\u0158, ale i v souvislosti s \u0159e\u0161en\u00edm bezpe\u010dnostn\u00edch incident\u016f v organizac\u00edch). Daj\u00ed se poznatky o obou oblastech znaleck\u00e9ho zkoum\u00e1n\u00ed n\u011bjak zobecnit? Ve sv\u011bt\u011b u\u017e takov\u00e9 zobecn\u011bn\u00ed a \u010dlen\u011bn\u00ed del\u0161\u00ed dobu existuje. Ta prvn\u00ed oblast zkoum\u00e1n\u00ed, tedy zji\u0161t\u011bn\u00ed toho, zda se ur\u010dit\u00e1 informace v po\u010d\u00edta\u010di nach\u00e1z\u00ed, je celkem jasn\u011b definov\u00e1na pojmem e\u2011discovery (vhodn\u00fd popis e\u2011discovery lze naj\u00edt nap\u0159. v hKps:\/\/cdslegal.com\/ knowledge\/the\u2011basics\u2011what\u2011is\u2011e\u2011discovery\/):<\/p>\n<p>[\/et_pb_text][et_pb_image src=&#8220;https:\/\/www.forensee.cz\/wp-content\/uploads\/2021\/03\/Vystrizek-2.jpg&#8220; title_text=&#8220;V\u00fdst\u0159i\u017eek 2&#8243; _builder_version=&#8220;4.9.2&#8243; _module_preset=&#8220;default&#8220;][\/et_pb_image][et_pb_text _builder_version=&#8220;4.9.2&#8243; _module_preset=&#8220;default&#8220;]<\/p>\n<p>S tou druhou oblast\u00ed vznik\u00e1 trochu probl\u00e9m. Obecn\u011b je definov\u00e1na jako \u201eDigital Forensics Analysis\u201c (DFA), ale zn\u00e1m\u00e9 definice jsou hodn\u011b obecn\u00e9 a rozpadaj\u00ed se vz\u00e1p\u011bt\u00ed na velkou skupinu definic r\u016fzn\u00fdch podoblast\u00ed forenzn\u00ed anal\u00fdzy digit\u00e1ln\u00edch dat (host forensics, network forensics, mobile forensics apod.). Tady vyu\u017eiji definici DFA, kterou jsem pou\u017eil ji\u017e v roce 2015 v \u010dasopisu \u201eDigital Forensic Journal 2\/2015\u201c (k dispozici je nap\u0159. v hKps:\/\/dfreview.cz\/_files\/ 200000027\u2011e6d33e6d36\/DFJ_2\u20112015.pdf):<\/p>\n<p>[\/et_pb_text][et_pb_image src=&#8220;https:\/\/www.forensee.cz\/wp-content\/uploads\/2021\/03\/priklad-3.png&#8220; title_text=&#8220;p\u0159\u00edklad 3&#8243; align=&#8220;center&#8220; _builder_version=&#8220;4.9.2&#8243; _module_preset=&#8220;default&#8220;][\/et_pb_image][et_pb_text _builder_version=&#8220;4.9.2&#8243; _module_preset=&#8220;default&#8220;]<\/p>\n<p>Na tomto m\u00edst\u011b je ale nutn\u00e9 zd\u016fraznit, \u017ee pojem e\u2011discovery nepoch\u00e1z\u00ed prim\u00e1rn\u011b z na\u0161eho (\u0159ekn\u011bme st\u0159edoevropsk\u00e9ho) prost\u0159ed\u00ed, ale je vyu\u017e\u00edv\u00e1n v prost\u0159ed\u00ed americk\u00e9m, kde m\u00e1 pom\u011brn\u011b stabiln\u00ed a obecn\u011b zn\u00e1mou pozici. V na\u0161em prost\u0159ed\u00ed se e\u2011discovery samostatn\u011b zat\u00edm t\u00e9m\u011b\u0159 nepou\u017e\u00edv\u00e1. Nicm\u00e9n\u011b prvn\u00ed vla\u0161tovky lze naj\u00edt i u n\u00e1s v praxi velk\u00fdch nadn\u00e1rodn\u00edch organizac\u00ed jak samostatn\u011b, tak v souvislosti s dal\u0161\u00ed velice p\u0159\u00edbuznou oblast\u00ed, kterou je oblast \u201eforensic readiness\u201c. Ale to by bylo pov\u00edd\u00e1n\u00ed na jin\u00e9 t\u00e9ma. V na\u0161em prost\u0159ed\u00ed jsou ob\u011b oblasti ch\u00e1p\u00e1ny spole\u010dn\u011b pod hlavi\u010dkou znaleck\u00e9ho zkoum\u00e1n\u00ed prost\u0159edk\u016f v\u00fdpo\u010detn\u00ed techniky.<\/p>\n<p><strong>Z\u00e1v\u011br<\/strong><\/p>\n<p>Od teoretick\u00e9ho pojedn\u00e1n\u00ed o digit\u00e1ln\u00ed stop\u011b, kter\u00e1 byla uve\u0159ejn\u011bna v minul\u00e9m \u010d\u00edsle na\u0161eho \u010dasopisu, jsem se v tomto \u010dl\u00e1nku p\u0159esunul k p\u0159edm\u011btu digit\u00e1ln\u00ed forenzn\u00ed anal\u00fdzy z pohledu oblast\u00ed zkoum\u00e1n\u00ed, se kter\u00fdmi se znalci v praxi obecn\u011b setk\u00e1vaj\u00ed. <br \/>Z jedn\u00e9 strany je to oblast, kter\u00e1 se zab\u00fdv\u00e1 zkoum\u00e1n\u00edm toho, <strong>co je ve v\u00fdpo\u010detn\u00ed technice ulo\u017eeno<\/strong>, tedy zejm\u00e9na vyhled\u00e1v\u00e1n\u00ed dat (nebo sp\u00ed\u0161e soubor\u016f) podle zadan\u00fdch krit\u00e9ri\u00ed. Obsah takto vyhledan\u00fdch dat je pak zadavatelem\/klientem posuzov\u00e1n vzhledem k vy\u0161et\u0159ovan\u00fdm skute\u010dnostem. Takov\u00e9 zkoum\u00e1n\u00ed se podle z\u00e1kladn\u00edch charakteristik velice p\u0159ibli\u017euje tomu, co je naz\u00fdv\u00e1no \u201eElectronic Discovery\u201c (jinak tak\u00e9 \u010dast\u011bji e\u2011dicovery). <br \/>Z druh\u00e9 strany je to oblast, kter\u00e1 se zab\u00fdv\u00e1 <strong>dokumentov\u00e1n\u00edm d\u011bj\u016f a proces\u016f, kter\u00e9 v informa\u010dn\u00edch syst\u00e9mech prob\u00edhaly<\/strong>. K tomu se prov\u00e1d\u00ed anal\u00fdza dat, kter\u00e9 s po\u017eadovan\u00fdmi procesy p\u0159\u00edmo \u010di nep\u0159\u00edmo souvisej\u00ed, tedy prob\u00edh\u00e1 anal\u00fdza hodnocen\u00ed obsah\u016f v\u0161ech relevantn\u00edch dat\/soubor\u016f. Podle definice digit\u00e1ln\u00ed forenzn\u00ed anal\u00fdzy, kter\u00e1 je uvedena (mimo jin\u00e9ho tak\u00e9) v \u010dasopise Digital Forensic Journal 2\/2015, je takov\u00e1 oblast zkoum\u00e1n\u00ed pr\u00e1v\u011b oblast\u00ed, kter\u00e1 je n\u00e1pln\u00ed t\u00e9to definice. <br \/>Proto\u017ee v\u0161ak v na\u0161em prost\u0159ed\u00ed obor znalectv\u00ed \u201eDigit\u00e1ln\u00ed forenzn\u00ed anal\u00fdza\u201c vlastn\u011b ofici\u00e1ln\u011b ani neexistuje, nelze se divit, \u017ee se tak\u00e9 nikdo nev\u011bnuje \u00favah\u00e1m o tom, jak\u00e9 r\u016fzn\u00e9 oblasti by takov\u00fd obor mohl pokr\u00fdvat. O rozd\u00edlech e\u2011discovery a digital forensic nemluv\u011b. Proto by u n\u00e1s znalci, kte\u0159\u00ed se zab\u00fdvaj\u00ed znaleck\u00fdm zkoum\u00e1n\u00edm informa\u010dn\u00edch technologi\u00ed, m\u011bli d\u011blat \u00fapln\u011b v\u0161echno, co s v\u00fdpo\u010detn\u00ed technikou p\u0159\u00edmo nebo nep\u0159\u00edmo souvis\u00ed. To, \u017ee takov\u00e9 p\u0159ehl\u00ed\u017een\u00ed problematiky znaleck\u00e9ho zkoum\u00e1n\u00ed digit\u00e1ln\u00edch informac\u00ed n\u00e1sledn\u011b p\u0159in\u00e1\u0161\u00ed obrovsk\u00e9 mno\u017estv\u00ed probl\u00e9m\u016f kvalifika\u010dn\u00edch, technologick\u00fdch a n\u00e1sledn\u011b i kvalitativn\u00edch, je nasnad\u011b.<\/p>\n<p>[\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>","protected":false},"excerpt":{"rendered":"<p>&nbsp; V na\u0161em prost\u0159ed\u00ed lze vypozorovat dv\u011b z\u00e1kladn\u00ed oblasti zkoum\u00e1n\u00ed digit\u00e1ln\u00edch dat. Zp\u0159\u00edstupn\u011bn\u00ed dat a anal\u00fdza dat. Tou prvn\u00ed je form\u00e1ln\u011b spr\u00e1vn\u00e9 ale relativn\u011b prost\u00e9 forenzn\u00ed vyhled\u00e1n\u00ed a poskytnut\u00ed dat zadavateli, tou druhou je anal\u00fdza d\u011bj\u016f a proces\u016f v prost\u0159edc\u00edch ICT. \u010cl\u00e1nek se zab\u00fdv\u00e1 \u00faskal\u00edmi obou oblast\u00ed. &nbsp; \u00davod V\u00a0minul\u00e9m \u010d\u00edsle Digital Forensic Review (2\/2019) [&hellip;]<\/p>","protected":false},"author":4,"featured_media":1781,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"","_et_gb_content_width":"","footnotes":""},"categories":[6,3],"tags":[],"class_list":["post-1772","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-forenzni-analyza","category-blog"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v20.9 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>E\u00ad-discovery vs Digital Forensics: \u00faskal\u00ed obou odv\u011btv\u00ed - forensee<\/title>\n<meta name=\"description\" content=\"V na\u0161em prost\u0159ed\u00ed lze vypozorovat dv\u011b z\u00e1kladn\u00ed oblasti zkoum\u00e1n\u00ed digit\u00e1ln\u00edch dat. Zp\u0159\u00edstupn\u011bn\u00ed dat a anal\u00fdza dat.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.forensee.cz\/en\/2021\/03\/26\/e-discovery-vs-digital-forensics-uskali-obou-odvetvi\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"E\u00ad-discovery vs Digital Forensics: \u00faskal\u00ed obou odv\u011btv\u00ed - forensee\" \/>\n<meta property=\"og:description\" content=\"V na\u0161em prost\u0159ed\u00ed lze vypozorovat dv\u011b z\u00e1kladn\u00ed oblasti zkoum\u00e1n\u00ed digit\u00e1ln\u00edch dat. Zp\u0159\u00edstupn\u011bn\u00ed dat a anal\u00fdza dat.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.forensee.cz\/en\/2021\/03\/26\/e-discovery-vs-digital-forensics-uskali-obou-odvetvi\/\" \/>\n<meta property=\"og:site_name\" content=\"forensee\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/forensee\" \/>\n<meta property=\"article:published_time\" content=\"2021-03-26T15:26:36+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2021-05-05T14:36:08+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.forensee.cz\/wp-content\/uploads\/2021\/03\/pexels-pixabay-270557.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"2316\" \/>\n\t<meta property=\"og:image:height\" content=\"1542\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Mari\u00e1n Svetl\u00edk\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@forensee\" \/>\n<meta name=\"twitter:site\" content=\"@forensee\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Mari\u00e1n Svetl\u00edk\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"13 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.forensee.cz\/2021\/03\/26\/e-discovery-vs-digital-forensics-uskali-obou-odvetvi\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.forensee.cz\/2021\/03\/26\/e-discovery-vs-digital-forensics-uskali-obou-odvetvi\/\"},\"author\":{\"name\":\"Mari\u00e1n Svetl\u00edk\",\"@id\":\"https:\/\/www.forensee.cz\/#\/schema\/person\/3c8e7324209cf97aa83d24dfe82f7b51\"},\"headline\":\"E\u00ad-discovery vs Digital Forensics: \u00faskal\u00ed obou odv\u011btv\u00ed\",\"datePublished\":\"2021-03-26T15:26:36+00:00\",\"dateModified\":\"2021-05-05T14:36:08+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.forensee.cz\/2021\/03\/26\/e-discovery-vs-digital-forensics-uskali-obou-odvetvi\/\"},\"wordCount\":4341,\"publisher\":{\"@id\":\"https:\/\/www.forensee.cz\/#organization\"},\"articleSection\":[\"Forenzn\u00ed anal\u00fdza\",\"Novinky\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.forensee.cz\/2021\/03\/26\/e-discovery-vs-digital-forensics-uskali-obou-odvetvi\/\",\"url\":\"https:\/\/www.forensee.cz\/2021\/03\/26\/e-discovery-vs-digital-forensics-uskali-obou-odvetvi\/\",\"name\":\"E\u00ad-discovery vs Digital Forensics: \u00faskal\u00ed obou odv\u011btv\u00ed - forensee\",\"isPartOf\":{\"@id\":\"https:\/\/www.forensee.cz\/#website\"},\"datePublished\":\"2021-03-26T15:26:36+00:00\",\"dateModified\":\"2021-05-05T14:36:08+00:00\",\"description\":\"V na\u0161em prost\u0159ed\u00ed lze vypozorovat dv\u011b z\u00e1kladn\u00ed oblasti zkoum\u00e1n\u00ed digit\u00e1ln\u00edch dat. Zp\u0159\u00edstupn\u011bn\u00ed dat a anal\u00fdza dat.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.forensee.cz\/2021\/03\/26\/e-discovery-vs-digital-forensics-uskali-obou-odvetvi\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.forensee.cz\/2021\/03\/26\/e-discovery-vs-digital-forensics-uskali-obou-odvetvi\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.forensee.cz\/2021\/03\/26\/e-discovery-vs-digital-forensics-uskali-obou-odvetvi\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Dom\u016f\",\"item\":\"https:\/\/www.forensee.cz\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"E\u00ad-discovery vs Digital Forensics: \u00faskal\u00ed obou odv\u011btv\u00ed\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.forensee.cz\/#website\",\"url\":\"https:\/\/www.forensee.cz\/\",\"name\":\"forensee\",\"description\":\"\u0158e\u0161en\u00ed a slu\u017eby v oblasti digit\u00e1ln\u00ed forenzn\u00ed anal\u00fdzy a \u0159\u00edzen\u00ed bezpe\u010dnosti informac\u00ed\",\"publisher\":{\"@id\":\"https:\/\/www.forensee.cz\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.forensee.cz\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.forensee.cz\/#organization\",\"name\":\"forensee\",\"url\":\"https:\/\/www.forensee.cz\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.forensee.cz\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.forensee.cz\/wp-content\/uploads\/2020\/05\/image.png\",\"contentUrl\":\"https:\/\/www.forensee.cz\/wp-content\/uploads\/2020\/05\/image.png\",\"width\":300,\"height\":75,\"caption\":\"forensee\"},\"image\":{\"@id\":\"https:\/\/www.forensee.cz\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/forensee\",\"https:\/\/twitter.com\/forensee\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.forensee.cz\/#\/schema\/person\/3c8e7324209cf97aa83d24dfe82f7b51\",\"name\":\"Mari\u00e1n Svetl\u00edk\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.forensee.cz\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/a3f8efc09c00e91f6084c019b7fd5caca44443a9d90cc14b97609e20909a918b?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/a3f8efc09c00e91f6084c019b7fd5caca44443a9d90cc14b97609e20909a918b?s=96&d=mm&r=g\",\"caption\":\"Mari\u00e1n Svetl\u00edk\"},\"url\":\"https:\/\/www.forensee.cz\/en\/author\/svetlik\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"E\u00ad-discovery vs Digital Forensics: \u00faskal\u00ed obou odv\u011btv\u00ed - forensee","description":"V na\u0161em prost\u0159ed\u00ed lze vypozorovat dv\u011b z\u00e1kladn\u00ed oblasti zkoum\u00e1n\u00ed digit\u00e1ln\u00edch dat. Zp\u0159\u00edstupn\u011bn\u00ed dat a anal\u00fdza dat.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.forensee.cz\/en\/2021\/03\/26\/e-discovery-vs-digital-forensics-uskali-obou-odvetvi\/","og_locale":"en_US","og_type":"article","og_title":"E\u00ad-discovery vs Digital Forensics: \u00faskal\u00ed obou odv\u011btv\u00ed - forensee","og_description":"V na\u0161em prost\u0159ed\u00ed lze vypozorovat dv\u011b z\u00e1kladn\u00ed oblasti zkoum\u00e1n\u00ed digit\u00e1ln\u00edch dat. Zp\u0159\u00edstupn\u011bn\u00ed dat a anal\u00fdza dat.","og_url":"https:\/\/www.forensee.cz\/en\/2021\/03\/26\/e-discovery-vs-digital-forensics-uskali-obou-odvetvi\/","og_site_name":"forensee","article_publisher":"https:\/\/www.facebook.com\/forensee","article_published_time":"2021-03-26T15:26:36+00:00","article_modified_time":"2021-05-05T14:36:08+00:00","og_image":[{"width":2316,"height":1542,"url":"https:\/\/www.forensee.cz\/wp-content\/uploads\/2021\/03\/pexels-pixabay-270557.jpg","type":"image\/jpeg"}],"author":"Mari\u00e1n Svetl\u00edk","twitter_card":"summary_large_image","twitter_creator":"@forensee","twitter_site":"@forensee","twitter_misc":{"Written by":"Mari\u00e1n Svetl\u00edk","Est. reading time":"13 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.forensee.cz\/2021\/03\/26\/e-discovery-vs-digital-forensics-uskali-obou-odvetvi\/#article","isPartOf":{"@id":"https:\/\/www.forensee.cz\/2021\/03\/26\/e-discovery-vs-digital-forensics-uskali-obou-odvetvi\/"},"author":{"name":"Mari\u00e1n Svetl\u00edk","@id":"https:\/\/www.forensee.cz\/#\/schema\/person\/3c8e7324209cf97aa83d24dfe82f7b51"},"headline":"E\u00ad-discovery vs Digital Forensics: \u00faskal\u00ed obou odv\u011btv\u00ed","datePublished":"2021-03-26T15:26:36+00:00","dateModified":"2021-05-05T14:36:08+00:00","mainEntityOfPage":{"@id":"https:\/\/www.forensee.cz\/2021\/03\/26\/e-discovery-vs-digital-forensics-uskali-obou-odvetvi\/"},"wordCount":4341,"publisher":{"@id":"https:\/\/www.forensee.cz\/#organization"},"articleSection":["Forenzn\u00ed anal\u00fdza","Novinky"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.forensee.cz\/2021\/03\/26\/e-discovery-vs-digital-forensics-uskali-obou-odvetvi\/","url":"https:\/\/www.forensee.cz\/2021\/03\/26\/e-discovery-vs-digital-forensics-uskali-obou-odvetvi\/","name":"E\u00ad-discovery vs Digital Forensics: \u00faskal\u00ed obou odv\u011btv\u00ed - forensee","isPartOf":{"@id":"https:\/\/www.forensee.cz\/#website"},"datePublished":"2021-03-26T15:26:36+00:00","dateModified":"2021-05-05T14:36:08+00:00","description":"V na\u0161em prost\u0159ed\u00ed lze vypozorovat dv\u011b z\u00e1kladn\u00ed oblasti zkoum\u00e1n\u00ed digit\u00e1ln\u00edch dat. Zp\u0159\u00edstupn\u011bn\u00ed dat a anal\u00fdza dat.","breadcrumb":{"@id":"https:\/\/www.forensee.cz\/2021\/03\/26\/e-discovery-vs-digital-forensics-uskali-obou-odvetvi\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.forensee.cz\/2021\/03\/26\/e-discovery-vs-digital-forensics-uskali-obou-odvetvi\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.forensee.cz\/2021\/03\/26\/e-discovery-vs-digital-forensics-uskali-obou-odvetvi\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Dom\u016f","item":"https:\/\/www.forensee.cz\/"},{"@type":"ListItem","position":2,"name":"E\u00ad-discovery vs Digital Forensics: \u00faskal\u00ed obou odv\u011btv\u00ed"}]},{"@type":"WebSite","@id":"https:\/\/www.forensee.cz\/#website","url":"https:\/\/www.forensee.cz\/","name":"forensee","description":"\u0158e\u0161en\u00ed a slu\u017eby v oblasti digit\u00e1ln\u00ed forenzn\u00ed anal\u00fdzy a \u0159\u00edzen\u00ed bezpe\u010dnosti informac\u00ed","publisher":{"@id":"https:\/\/www.forensee.cz\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.forensee.cz\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.forensee.cz\/#organization","name":"forensee","url":"https:\/\/www.forensee.cz\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.forensee.cz\/#\/schema\/logo\/image\/","url":"https:\/\/www.forensee.cz\/wp-content\/uploads\/2020\/05\/image.png","contentUrl":"https:\/\/www.forensee.cz\/wp-content\/uploads\/2020\/05\/image.png","width":300,"height":75,"caption":"forensee"},"image":{"@id":"https:\/\/www.forensee.cz\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/forensee","https:\/\/twitter.com\/forensee"]},{"@type":"Person","@id":"https:\/\/www.forensee.cz\/#\/schema\/person\/3c8e7324209cf97aa83d24dfe82f7b51","name":"Mari\u00e1n Svetl\u00edk","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.forensee.cz\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/a3f8efc09c00e91f6084c019b7fd5caca44443a9d90cc14b97609e20909a918b?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/a3f8efc09c00e91f6084c019b7fd5caca44443a9d90cc14b97609e20909a918b?s=96&d=mm&r=g","caption":"Mari\u00e1n Svetl\u00edk"},"url":"https:\/\/www.forensee.cz\/en\/author\/svetlik\/"}]}},"_links":{"self":[{"href":"https:\/\/www.forensee.cz\/en\/wp-json\/wp\/v2\/posts\/1772","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.forensee.cz\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.forensee.cz\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.forensee.cz\/en\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.forensee.cz\/en\/wp-json\/wp\/v2\/comments?post=1772"}],"version-history":[{"count":6,"href":"https:\/\/www.forensee.cz\/en\/wp-json\/wp\/v2\/posts\/1772\/revisions"}],"predecessor-version":[{"id":1817,"href":"https:\/\/www.forensee.cz\/en\/wp-json\/wp\/v2\/posts\/1772\/revisions\/1817"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.forensee.cz\/en\/wp-json\/wp\/v2\/media\/1781"}],"wp:attachment":[{"href":"https:\/\/www.forensee.cz\/en\/wp-json\/wp\/v2\/media?parent=1772"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.forensee.cz\/en\/wp-json\/wp\/v2\/categories?post=1772"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.forensee.cz\/en\/wp-json\/wp\/v2\/tags?post=1772"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}