SOME FEATURES OF EXTRACTING AND AUTHENTICATING DIGITAL EVIDENCE FROM MOBILE DEVICES WHEN INVESTIGATING PHISHING ATTACKS

Abstract

The article examines certain criminalistic and organizational-procedural aspects of the seizure and authentication of digital evidence from mobile devices during the investigation of phishing attacks. The relevance of the topic is due to the rapid growth in the number of cybercrimes in which mobile phones are the main tool of communication between the criminal and the victim, a means of accessing banking services, and at the same time a carrier of a significant amount of digital traces. In such conditions, a mobile device becomes an important source of evidence that allows reconstructing the mechanism of criminal activity, establishing the sequence of events, identifying the persons involved, and confirming the fact of illegal acquisition of confidential data or funds. The paper analyzes the specifics of the formation of digital traces in the mobile environment during the implementation of phishing schemes carried out via SMS messages, e-mail, messengers, social networks, and fake web resources.It is argued that the effectiveness of investigating such offenses largely depends on the correctness of the initial actions to identify, record, seize, and preserve data from mobile devices. Particular attention is paid to the technical and forensic features of working with digital information stored on smartphones, including call logs, messenger correspondence, web browsing history, system logs, file metadata, banking application data, and other artifacts of user activity. The article reveals problematic issues of ensuring the integrity of digital evidence related to its dynamic nature, the possibility of remote deletion or modification, the use of modern encryption mechanisms, and data synchronization with cloud services. The article analyzes modern approaches to extracting data from mobile devices, outlines the importance of logical, file, and physical information retrieval, and emphasizes the need to adhere to the principles of preserving the original state of digital data. The issue of digital evidence authentication is considered separately, in particular the use of cryptographic checksums, ensuring the chain of evidence preservation, and the use of special knowledge in the field of digital forensics. It was concluded that proper organization of the process of extraction and authentication of digital evidence from mobile devices is crucial for establishing the objective circumstances of phishing attacks and ensuring the admissibility of evidence in criminal proceedings. A generalized approach to the investigation of mobile devices as a source of criminally significant information is proposed, which involves combining technical methods of digital forensics with procedural requirements for evidence.