Forensic Investigation of Distributed Information

The paper notes the increasing importance of a new form of information–distributed information. The author analyzes legal events that necessitate forensic research of distributed information, as well as the most frequently committed crimes using distributed information services. The basic rules for the functioning of distributed information systems are defined. It is stated that most often in the practice of investigation there is a need to study file-sharing networks and their variety such as torrents. The basics of file-sharing networks are considered. Taking into account the conducted research, the author’s classification of file-sharing networks is proposed. The paper defines the main forensically significant tasks of studying file-sharing networks. These include: restoration of the entire information object from parts; identification of the user and his identifiers; proof of the user’s awareness of the content of the information objects in his possession; proof of intent to distribute; the principles of solving the above problems are considered sequentially. In the course of a comparative study of holding file-sharing network providers accountable, it was found that, unlike many foreign countries, in Russia there is virtually no legal basis for holding a peer-to-peer network provider accountable (but even in the latest generation of networks, the provider has virtually no control over the content of the network). It is noted that most investigators have insufficient knowledge in the area under consideration. It seems urgently necessary to organize periodic advanced training courses that cover new technologies and the principles of their research.