Law Journal of the National Academy of Internal Affairs

The purpose of this article is to attempt to address theoretical and practical issues related to the use of information technology directly in forensic activities when conducting computer forensics. Methodology. To achieve this goal, we use general scientific and special methods, which are the means of scientific search. In particular, the method of system analysis, as well as system-structural, formal-logical and statistical methods made it possible to analyze the genesis of the formation and development of computer -technical forensic examination, to reveal the essence of its tasks and the peculiarities of the study of relevant objects both individually and in complex. Scientific novelty is due to the formation of new tools in combating crime. The main tasks of computeraided forensic analysis are distinguished: diagnostics of computer system hardware; determination of functional purpose, characteristics and realized requirements, algorithm and structural features, current state of the presented system and application software; search, detection, analysis and evaluation of cybernetic information (computer data) prepared by the user or created by programs for organizing information processes in the computer system. The objects of computer forensics are classified. Conclusions. The main requirements for the questions to be answered by the expert in the appropriate type of expertise are summarized. The mistakes most often made in criminal proceedings by investigators and operatives during the preparation of objects for inves tigation, as well as the courts (investigating judges) when appointing computerized forensics are analyzed. A list of common questions that can be asked by an expert is formulated, as well as general requirements for the objects that are submitted for the computer forensic examination.