디지털 포렌식

2018.6.7.에 임명된 드루킹의 인터넷상 불법 댓글 조작 사건과 관련된 진상규명을 위한 특별검사로서는 수사의 관건이 디지털증거의 확보와 분석임을 알았습니다. 역대 어느 특검보다도 디지털포렌식의 중요성이 큰 사건이기에 디지털증거의 확보와 해독, 분석,범죄사실과의 관련성 판단, 증거물의 보존, 입증계획과 대비 등 디지털증거의 사법적대응은 단계마다 한치의 오차가 없는 기술적 정치함과 증거가치를 확보하기 위한 엄격한 법률적 기준 준수가요구되었습니다. 흔히 포괄적인 과학적 수사기법을 의미하는 포렌식은 디지털과 만나면 완전히 새로운 양상을띠게 됩니다. 현장에서 확보하는 스마트폰, 태블릿, 컴퓨터 등의 디지털데이터 저장매체에서 수집된 전자적 증거물 등은 식별(Identification), 수집(Collection), 획득(Acquisition), 보존(Preservation), 분석(Analysis)을 거쳐서 유의미한 내용을 현출할 수 있습니다. 하지만 이 데이터를 사법적으로 유효한 증거로 사용할 수 있으려면 법률적 기준에 맞추어 검증하여야 하는데그 검증과정과 기준은 매우 엄격합니다. 처리해야 할 디지털 증거물(대략 28TB)에 이 모든 과정을 책임지고 완벽하게 수행할 특별수사관이 절실하였습니다. 이 수사팀을 이끌 분으로 실무와 이론을 겸비한 강구민 성균관대 과학수사학과 교수를 초빙하였고 경찰청에는 컴퓨터포렌식 전문가인 서울지방경찰청의 천성덕 수사관과 모바일포렌식 전문가인 경찰청 보안국의 김무석 수사관을 초치하였습니다. 이 분들이 유례없는 폭염속에서, 준비한 장비는 물론 개인장비와 분석 툴을 24시간 가동하여 50여일 내내 엄청난 분량의 디지털자료를 해독하고 분석하며 그 내용을 일일이 확인하는 고된작업을 수행하셨습니다. 분석과 아울러 법정증거사용에 반드시 요구되는 무결성과 동일성, 진정성을 수집단계부터 모두 완벽하게 갖추어 가며 단서를 찾아내고 결과물을 내어놓은 것은 감탄을 넘어 기적이었습니다. 이 분들의 노력과 헌신과 열정이 있었기에 이후의 공판과정에서 디지털증거자료를 온전히 법정에 현출할 수 있었음을 새삼 고맙게 생각합니다. 이미 깊은 디지털증거법이론으로 무장한 강구민 박사와 천성덕, 김무석 수사관이 공학적면과 사법적면을 접목시킨 『디지털포렌식』을 출간한 것은 필연입니다. 더욱이 각각의 전문적인 분야는 많은 발전이 있었지만 양 분야를 이론과 실무적으로 통합한 연구서는 전무한 현실에서 이 책이 가지는 가치는 매우 크다 할 것입니다. 디지털매체의 사용이 증가함에 따라 날이 갈수록 디지털포렌식의 사회적 수요는 매우 커지고 있습니다. 단순히 수사영역에서의 중요성을 넘어서 사실확인을 위한 모든 분야에서 그 활용도는 무궁무진합니다. 디지털포렌식의 수요가 앞으로 더욱 늘어날 것이 확실시 되는 현실에서, 이 책은 학문적으로도 중요한 가치가 있을 뿐만 아니라 일선 실무 현장의 수사관들에게 많은 도움이 될 것으로 기대합니다. 나아가 디지털포렌식에 대한 올바른 이해를 위한 기본서로서 디지털포렌식 전문가를 희망하는 분들에게 꼭 필요한 지침서가 될 것입니다. 특별검사 허익범

12 │디지털 포렌식 제1편 디지털􀀁포렌식􀀁관련􀀁법률 제1장 서설 ·········································································································· 17 제2장 디지털 증거의 압수･수색 ············································································· 18 제1절 압수･수색 일반 ·························································································· 19 제2절 디지털 증거의 압수･수색 ·········································································· 28 제3장 디지털 증거법 ···························································································· 35 제1절 증거법 일반 ····························································································· 35 제2절 과학적 증거방법으로서의 디지털 포렌식 ······················································ 45 제3절 디지털 포렌식 분석 자료에 대한 증거능력 ·················································· 58 제4장 전자적 증거개시와 증거조사 ········································································ 82 제1절 전자적 증거개시 ························································································ 82 제2절 디지털 증거의 증거조사 ············································································ 95 제3절 디지털 포렌식 수사관의 법정 증언 ···························································· 118 제2편 디지털􀀁포렌식􀀁수사절차 제1장 서설 ········································································································ 129 제2장 디지털 포렌식 수사절차 ············································································· 130 제1절 일반 사항 ······························································································ 130 제2절 압수･수색영장 집행 전 단계 ······································································ 134 제3절 압수･수색영장 집행 단계 ··········································································· 144 제4절 디지털 증거분석 절차 ················································································ 154 제3장 디지털 포렌식 확인서 작성례 ····································································· 159 제1절 개요 ········································································································ 159 제2절 각 단계에서의 확인서 작성 ········································································ 160 제3편 디지털􀀁포렌식􀀁분석 제1장 서설 ········································································································ 171 제2장 디지털 증거의 무결성 확보 ······································································· 172 제3장 컴퓨터 포렌식 분석 ·················································································· 180 제1절 개요 ···································································································· 180 제2절 분석방법 ································································································ 181 제4장 모바일 포렌식 분석 ··················································································· 207 제1절 개요 ······································································································· 207 제2절 분석방법 ································································································· 208 제4편 디지털􀀁포렌식􀀁관련􀀁규정􀀁해설 1. 경찰청훈령, 「디지털 증거 수집 및 처리 등에 관한 규칙」··································· 253 2. 대검찰청예규, 「디지털 증거 수집·분석 및 관리 규정」········································ 263 3. 공정거래위원회고시, 「디지털 증거의 수집·분석 및 관리 등에 관한 규칙」············· 281 4. 고용노동부예규, 「디지털 증거 수집·분석 및 관리 규정」····································· 291 5. 방송통신위원회훈령, 「방송통신위원회 조사절차에 관한 세부 업무처리 지침」········· 301 6. 중앙선거관리위원회훈령, 「디지털 증거 및 전자 게시물 정보의 수집･분석･관리 등에 관한 규정」································································································· 309