Counter forensics as a threat to the information security of Ukraine: the problem of forensic expertise of digital evidence in the realities of war

It is indicated that the current military aggression against Ukraine is characterized by large-scale cyberattacks and information operations that create serious risks for state information security. Among the new threats, a special place is occupied by the phenomenon of counter-forensics - a set of techniques designed to complicate or distort electronic evidence in order to avoid punishment. The article examines the phenomenon of counter forensics as a component of a hybrid threat to the information security of Ukraine in the conditions of a full-scale war. The authors of the article carried out a comprehensive analysis of concepts, technologies and practices aimed at complicating or distorting digital evidence in order to hinder criminal proceedings. The main types of counter forensic influences are identified - from the destruction of traces, falsification of metadata, steganography to attacks on forensic analysis tools. Particular attention is paid to the vulnerability of digital evidence during war and the practice of their use in criminal proceedings regarding war and cybercrimes. Separate examples from judicial and investigative practice, as well as specific cyber incidents of the Russian-Ukrainian war of 2022–2024, are analyzed, which indicate the use of counter forensics methods by the aggressor. It is established that the systematic use of such techniques undermines trust in electronic evidence, complicates the establishment of the truth and jeopardizes the effectiveness of justice. At the same time, the author outlines the key problems of forensic activity in the digital sphere - fragmentation of regulatory regulation, lack of human and technical potential, lack of a single center of competence in digital forensics. Based on the analysis, recommendations are formulated to improve regulatory support, update methods for forensic examination of digital evidence, implement international standards (ISO/ IEC), improve the skills of experts and create a national center for digital forensics. It is emphasized that effective counter-forensics is a necessary condition for ensuring information security and justice in the conditions of modern military conflicts.