Search

Search Results

• COMPUTATIONAL FORENSICS METHODOLOGY AND FORMAL VERIFICATION OF EXPERT FINDINGS

  Е.S. Abramov

  45-68

  2026-07-07

  Abstract ▼

  This paper addresses the fundamental challenge of overcoming the systemic epistemological crisis in digital forensics. This crisis is driven by an expanding semantic gap between the probabilistic and stochastic nature of digital traces—frequently compromised by anti-forensic techniques—and the rigorous demands of adversarial legal proceedings for the legal certainty of evidence. The article is conceptual in nature and establishes the theoretical foundation of computational forensics as an independent scientific discipline. The study justifies a necessary paradigm shift from traditional heuristic artifact-discovery approaches and subjective expert opinions toward a rigorous methodology grounded in the principles of algorithmic reproducibility, the measurability of uncertainty, and formal verifiability. The author develops a set-theoretic ontological model of a computer incident, which is built upon the "subject–method–object" (S-M-O) triad and the axiom of process trace conservation. This model enables a one-to-one mapping of low-level technical indicators (IoA, IoB, IoC) onto the legal elements of a crime (corpus delicti). Furthermore, a methodology for the formal verification of hypothesis validity is proposed, incorporating the criteria of structural completeness, causal coherence, logical consistency, and factual grounding. For the first time, a mathematical model for assessing the reliability of expert findings using a logistic function (trust function) is introduced into scientific discourse. This model enables the calculation of the probability of a juridical fact by aggregating taxonomic compliance metrics, the strength of causal relationships within the incident graph, and an environmental entropy penalty. The application of the developed approach transforms forensic incident reconstruction from an ill-posed inverse problem into a deterministic procedure, ensuring the mathematically provable objectivity of the evidentiary base even under conditions of incomplete data and active anti-forensic countermeasures.