MODERN POSSIBILITIES OF COMPUTER TECHNICAL EXAMINATION IN THE INVESTIGATION OF CRIMES IN THE FIELD OF INFORMATION TECHNOLOGIES

Mamatkulova Khosiyat Lecturer Department of the Criminal procedure and Criminalistics Tashkent State University of Law 100047, 35, Sayilgox str., Tashkent, Uzbekistan. ...................................................................................................................... Manuscript Info Abstract ......................... ........................................................................ Manuscript History Received: 14 October 2019 Final Accepted: 16 November 2019 Published: December 2019


ISSN: 2320-5407
Int. J. Adv. Res. 7 (12), 1029-1032 1030 progress and results of forensic research. Thus, it can be concluded that forensic examination is a special procedural action carried out in the event that issues arise that require special knowledge in the field of science, technology, art or craft.
The concept of forensics, as a means of evidence, is present in all processes. Forensic examination is a separate and independent type of evidence, which has the same evidentiary power before the law as other evidence. The subject of the examination is information about expert tasks, expert methods, methods for resolving issues, as well as information about objects and their properties. The subject of research in the framework of the examination is the subject of knowledge. The subject of cognition refers to information about objects, goals and conditions of research, obtained in experience and used in practice. Turning directly to the subject of research, it should be noted that forensic computer-technical examination is a relatively new and one of the most demanded examinations. This type of expertise is sometimes called computer expertise, software expertise, programme-technical expertise and other options.
There are various definitions of scientists regarding this type of expertise. Propastin S.V. [8] notes that a forensic computer examination is an independent study of information recorded in electronic form, as well as hardware and software of a computer system, carried out by an expert (specialist) in the manner established by the criminal procedure legislation, in order to give an opinion on facts that have significance for the criminal case.
Smolina A.R. [12] under the computer-technical expertise suggests to understand an independent kind of forensic examinations, belonging to the class of engineering-technical examinations, carried out in order to identify and study the trace in the investigated crime, through a comprehensive study of computer tools: the technical (hardware) part of computer tools; software; network information technology facilities; information contained in a computer system.
It should be noted that the moment of formation of computer-technical expertise as an independent kind can be considered 2001-2002, when the book of Rossinskaya E.R. and Usova A.I. "Forensic computer-technical examination", as well as A.I. Usov defended his doctoral dissertation "Conceptual Foundations of Forensic Computer-Technical Expertise".
The subject of forensic computer-technical examination (FCTE) is the facts and circumstances established on the basis of a study of the laws of development and operation of computer tools that ensure the implementation of information processes, which are recorded in the materials of a criminal, civil case, administrative case [13].
In 2000, Rossinskaya E.R. and Usov A.I. in the work "Classification of computer-technical expertise and its tasks" introduced the classification of FCTE, based on the supporting components of a computer tool. In accordance with this, the following types of forensic examinations were distinguished: hardware-computer, software-computer and information-computer examinations. Another type of expertise was also introduced -computer-network expertise. The appearance of this type expertise was based on the allocation of knowledge into a separate industry and the rapid development of network technologies. [9] Sharing the position of Rossinskaya E.R., Averyanova T.V. proposes to supplement the examination with several more types -engineering-psychological and examination of the functioning of computers in the network [1].
The essence of hardware-computer expertise is to conduct research (mainly diagnostic) of technical (hardware) means of a computer system. Hardware includes: electrical, electronic and mechanical circuits, blocks, devices and devices that make up the material part of a computer system. The subject of this type of examination is facts and circumstances that are relevant to a criminal or civil case and are established on the basis of a study of the laws governing the development and operation of the hardware of a computer systemmaterial carriers of information about the fact or event of a criminal or civil case.
To conduct expert research of software, this type of expertise is designed as software-computer expertise. Its specific subject is the laws of development (creation) and application (use) of the software of a computer system submitted for research in order to establish the truth in a criminal or civil case. The objectives of this type of examination is to study the functional purpose and characteristics of the implemented algorithm, structural features and the current state of the system and application software of a computer system. Information-computer examination (of data) is a key type of forensic computer-technical examination, as it allows to complete the integrated construction of the evidence base by final resolution of most diagnostic and identification 1031 issues related to computer information. The tasks of this type are the search, detection, analysis and evaluation of information prepared by the user or generated (created) by programs for organizing information processes in a computer system.
In addition, there is also another new type of forensic computer-technical examination -computer-network examination. This examination, unlike the previous ones, is based primarily on the functional purpose of computer tools that implement any kind of network information technology. Therefore, the facts and circumstances associated with the use of network and telecommunication technologies and established by order of the investigating and judicial authorities in order to establish the truth in a criminal or civil case constitute a specific subject of computernetwork examination. This examination is highlighted in a separate form due to the fact that only the use of special knowledge in the field of network technologies allows you to combine the obtained objects, information about them and effectively solve the assigned expert tasks.
It should be noted that the issue of the production of this type of examination was resolved with the adoption of a resolution of the President of the Republic of Uzbekistan dated January 17, 2019 "On measures to further improve forensic science activity" [5]. One of the important innovations introduced in accordance with these acts is the permission to create non-governmental forensic organizations with the right to conduct certain types of forensic examinations. So one of these types of examinations is forensic-computer-technical expertise. Also, in accordance with this resolution, a laboratory of computer-technical expertise was established at the Tashkent University of Information Technologies named after Muhammad al-Kharizmi.
Among the possibilities of forensic computer-technical expertise, it should be noted that with the increase of information and communication and computer technologies in people's activities, there is an increasing risk of violating the security of these technologies and, accordingly, of committing various crimes. So, the list of crimes in this area is fixed in a special Chapter 20 of the Criminal Code of the Republic of Uzbekistan "Crimes in the field of information technology".
Depending on what crime in the field of information technology is committed, appropriate actions for this category are required: inspection, seizure, obtaining samples, appointment of expertise, etc.
As it has been already noted, forensic computer-technical expertise is a fairly new kind of forensic expertise. It is important to note that the priority area of development is to ensure the production process aimed at solving specific practical problems of forensic information-computer examination. Their weakness remains the flaw on the part of law and the theoretical foundations of forensic examinations. In addition, of great importance is the fact that today technological progress in the field of information and computer technologies is developing most intensively, which, in turn, does not allow experts to create step-by-step recommendations for solving problems of other types of forensic computer-technical expertise. [10] Semikalenova A.I., Khatuntsev N.A. define errors in the production of forensic computer-technical examination based on the stage of production of the examination (preparatory, direct stage of production and in drawing up a conclusion), in addition, they highlight errors of a methodological nature, etc. For example, one of the errors is the discrepancy between the competence of the specialist who conducted the examination of the specialization of computer-technical examination. To conduct a forensic computer-technical examination, a specialist must have knowledge in the field of: electronics and electrical engineering; computer networks and telecommunications facilities; Internet technology methods and means of information protection; basics of algorithmization and programming; databases and data banks; peripheral devices; circuitry of telecommunication devices; methods and means of expert research of computer facilities and mobile devices.
In accordance with these main specialties of higher professional education, the knowledge that future specialists receive is the basis for the training of experts in forensic computer-technical expertise. Due to this, it is necessary to develop an appropriate system of training, retraining of specialists for this group of expertise. The specifics of expert training should take into account the development of information technology, the emergence of new methods of committing and concealing crimes. [7] Speaking about expert errors, one cannot ignore the problem of obtaining samples for a comparative study of mainly software products. Often, when appointing such an examination, the courts do not have samples for a comparative study and do not know where to get them. In this case, the parties may submit samples for a comparative study.

1032
However, it remains unknown how legitimate these samples are, since the source of their origin, the form and completeness of the presentation are not always clear, and the question of the parties' interest in the outcome of the case remains. Given these circumstances, we propose to fix a special rule, in accordance with which to establish the mandatory participation of a specialist in obtaining samples for the production of forensic computer-technical expertise. So, it is proposed to supplement article 189 of the Code of Criminal Procedure of the Republic of Uzbekistan with the third part as follows: "When receiving electronic and other samples for computer-technical research, the participation of a specialist is mandatory".
In addition, the questions posed in the determination or decision and submitted for permission by the expert also require special attention. So, the persons who appoint the expertise and do not speak well of the special terminology used in information and computer technologies incorrectly use it when formulating questions. This is due to the fact that modern computerization of society has led to the widespread use of various specialized terms in the media without reference to their true purpose and definition, which ultimately leads to the creation of a false sense of competence among people who do not specialize in computer technology. This fact, in turn, leads to a distortion of their interpretation by experts in the field of forensic computer-technical examination, which leads to confusion. In order to prevent such errors, we suggest increasing the degree of interaction between the person who appointed the examination and the expert. For example, an expert can clarify the essence of the issue and, with the permission of the person who appointed the examination, reformulate the question, indicating this in the expert opinion.

Conclusion:-
Based on the aforementioned, we can conclude that this type of examination, such as forensic computer-technical examination, is relatively new and requires the settlement of many issues mentioned in this work. It is proposed to amend the procedure for training and retraining of specialists in this type of examination. It is also proposed to make abovementioned changes and additions to the criminal procedure legislation of the country.