行動惡意程式攻擊數位證據鑑識調查處理程序之研究

鑑於行動網路與通信科技蓬勃發展，行動設備（ Mobile Devices），存有豐富的個人資訊能力，並具備高度機動性，和強大的軟硬體功能帶動各層面的廣泛運用，然而，手機詐財簡訊、多媒體簡訊與行動惡意程式攻擊等行動領域中的數位犯罪手法推陳出新，行動設備已成為許多犯罪者所使用的高科技犯罪工具。本研究首先針對行動惡意程式攻擊行為靜態分析，再進行深入的惡意程式動態分析，探討數位證據鑑識處理程序，研制有關行動設備數位證據的處理程序及規則。最後，利用行動通訊設備鑑識軟體作為的主要鑑識工具，讓鑑識人員能夠運用此鑑識程序與鑑識工具，即可完成鑑識工作，了解恰當的保護證據保管鏈（ Chain ofCustody, CoC），便於日後的調查分析提供數位證據，並於法庭上補強數位證據的完整性、一致性和精確性。

關鍵字

行動設備；惡意程式；數位證據鑑識；處理程序；證據保管鏈

並列摘要

According to the massive development of mobile and communications technology, the mobile devices now are highly performed in personal information capacity and the mobility, both of the powerful hardware and software are encouraging the dependence of full aspects. Whereas, the means of the phone based swindles, MMS and mobile malicious code attacks also evolve everyday, which makes the mobile devices become the high-tech crime tool used by many offenders. First of all, this study will be directed against the static analysis of the malicious code attacks, and then conduct in-depth analysis of which dynamically to compromise digital evidence forensics procedures and regulations, then set them up. Accordingly, for the forensic officers, they can merely use the software against mobile communication as the main tools by following the procedure to accomplish their duty. This will ensure the proper preservation of evidence Chain of Custody （ CoC）, to facilitate proceeding investigation and analysis by providing digital evidence. Eventually, to reinforce integrity, consistency and accuracy of the digital evidence in the court of law.