IMPROVING DIGITAL FORENSICS METHODS IN CYBERCRIME DETECTION

The article examines current problems in applying digital forensics methods to the detection and investigation of cybercrimes. The key factors that reduce the effectiveness of traditional approaches are analyzed: the explosive growth of digital data volumes, ubiquitous encryption, the spread of cloud services, Internet of Things devices and anti-forensic techniques. Based on an analysis of the international standards ISO/IEC 27037 and NIST SP 800-86, an improved six-stage model of digital forensic examination is proposed. The model includes automated prioritization (triage) of evidence sources, priority acquisition of volatile data, cryptographic integrity control with an immutable chain-of-custody log, and timeline correlation analysis supported by machine learning. A weighted model for assessing the priority of digital sources is proposed. It is shown that the proposed approach makes it possible to reduce the time of preliminary analysis and to increase the evidentiary value of digital traces.