The Smoking Gun is in Your Smartphone... The World of 'Digital Forensics'

Digital Forensics Recognizes Only Evidence Preserved in Original Form
Smartphone Forensics Essential to Verify Location Data and Chat History

[Asia Economy Reporter Han Jinju] The importance of 'digital forensics' is increasing day by day in the investigation of incidents and accidents. Unlocking smartphones to find key evidence through chat histories, movement routes, call logs, files, and memos plays a crucial role in determining the investigation period and outcome.

Digital forensics refers to the process of securing evidence from computers or smartphones during the investigation of criminal acts. In the past, evidence was mainly secured from laptops and PCs, but recently, key evidence for criminal investigations increasingly comes from smartphones. Smartphone manufacturers are also enhancing security features, making it more difficult to unlock passwords and secure necessary evidence without damaging the original data.

Digital evidence is easily deleted or tampered with, so special procedures or methods are required when storing or obtaining evidence. Information that holds evidentiary value must be collected and documented, and it must be verified that the process was lawful to be recognized as evidence. In other words, when handling evidence in forensics, it must be proven that there are no issues with the evidence. Typically, forensic programs provide evidence acquisition or analysis by using copied images instead of original files to examine the files.

In the past, Apple engaged in legal battles with the FBI over unlocking an iPhone used by a terrorist. The FBI succeeded in accessing internal data with the help of Cellebrite, an Israeli mobile forensic company. Domestic investigative agencies also used Cellebrite's equipment to unlock iPhones during the investigation of the Blue House election interference allegations. Cellebrite's smartphone forensic program bypasses pattern locks or passwords to secure stored files, chat contents, text message records, and location information. On the 17th, the police decided to begin digital forensics on one iPhone used by the late Mayor Park Won-soon with the consent of the bereaved family. It is expected that evidence related to sexual harassment allegations will be secured through the forensics process.

Domestic investigative agencies are also strengthening digital forensic investigations, and related laws have been amended to expand the scope of digital forensic use. In 2007, the Seoul Central District Prosecutors' Office established a digital forensic investigation team, and in 2008, the National Digital Forensic Center was created under the Supreme Prosecutors' Office. Digital forensic investigators appointed by the Prosecutor General handle investigations ranging from video analysis, psychological analysis, and document appraisal to DNA forensic science and cybercrime.

The amended law recognizing materials secured through digital forensics as 'digital evidence' has also contributed to the expanded use of forensics. In May 2016, Article 313, Paragraph 1 of the Criminal Procedure Act was revised to include 'information such as text, photos, videos stored on computer disks' and other similar information storage media, i.e., 'information' in the definition of statements.

Key evidence that appeared during recent major investigations was secured through digital forensics. In 2014, KakaoTalk conversations between Sewol ferry passengers and their families were admitted as evidence in court. In the Sookmyung Girls' High School twin exam paper leak case, the police presented English answers left in phone memos as evidence. During investigations of the Doctor's Room and Nth Room suspects, who distributed and possessed sexually exploitative videos via Telegram, the police reportedly secured evidence through digital forensic work involving Telegram and virtual currency transaction records.

This content was produced with the assistance of AI translation services.