Research On Measurement Method Of Electronic Data Uncertainty

Electronic data is widely used in all kinds of judicial cases,playing a more and more prominent role.At present,the identification norms or application standards of electronic data generally require deterministic results and opinions,which often exclude the consideration of uncertainty.However,in the life cycle of electronic data,uncertainty exists objectively along with the application of evidence.Due to the lack of understanding,analysis and measurement of uncertainty,parties with different roles and standing on different positions may put forward significantly different opinions,or even produce disputes and engage in some debates without practical value.Specifically,the uncertainty of electronic data also affects the ability of existing evidence analysis models to accurately assess the likelihood of an event occurring.This thesis focuses on the study of the uncertainty of electronic data in the review and judgment of electronic data.The main work includes the following three parts:1.Study the uncertainty of electronic data.Through a detailed analysis of the uncertainties faced by electronic data throughout its life cycle,this thesis divides the uncertainties into three types: "information uncertainty","behavior-related uncertainty" and "identity-related uncertainty".In order to reduce the uncertainty caused by description of evidence information,this thesis proposes a method to identify the authenticity of electronic data based on time attribute.By extracting and parsing file metadata,$Log File,$USNjrnl,Prefetch file and other information are used to identify.The establishment of eight identification rules can identify the authenticity of evidence information in cases and improve the credibility of forensic analysis results.2.Aiming at the two kinds of problems of "behavior-related uncertainty" and "identity-related uncertainty",the uncertainty measurement method based on DempsterShafer evidence theory is proposed.Firstly,the behavior hypothesis correlation algorithm is used to analyze the possible behaviors associated with the electronic data.Then,the data are described in a clear way through the data recovery classification method and the likelihood ratio method to reduce the misunderstanding and uncertainty of digital forensics.Finally,based on Dempster-Shafer evidence theory,information entropy is introduced to determine the weight of different electronic data,which makes the evaluation of electronic data more objective and fair.3.Establishing an electronic data evaluation system.In order to reduce the uncertainty in the process of evidence evaluation,this thesis proposes a relatively unified scientific quantitative evaluation method.This method realizes the conversion between qualitative and quantitative through The Cloud model,and realizes the rationality of the evaluation index weight through the Dempster-Shafer evidence theory.From the two aspects of admissibility and reliability,electronic data evaluation indicators are established to evaluate whether electronic data meets the requirements of judicial review and form credible evaluation results.