• Review of KIISC
• /
• v.22 no.7
• /
• pp.7-13
• /
• 2012

클라우드 컴퓨팅은 네트워크, 스토리지, 서버, 응용프로그램 등과 같은 컴퓨팅 자원에 언제든지 편리하게 접근할 수 있는 새로운 컴퓨팅 모델이다. 클라우드 컴퓨팅은 기존의 컴퓨팅 환경과 다르게 다양한 단말 기기를 통해 접속할 수 있고, 사용자의 데이터를 로컬이 아닌 원격지에 저장하며, 작업 상태를 실시간으로 업데이트한다는 특징이 있다. 클라우드 컴퓨팅 환경에서 사용자의 데이터가 원격지에 존재하고, 서비스 제공자에 의해 관리되기 때문에 데이터 보안의 관점에서 위협 요소가 있을 수 있다. 또한 범죄와 관련된 데이터가 클라우드 시스템에 저장되어 있을 수 있다. 이를 조사하기 위해서 클라우드 컴퓨팅 환경에 적합한 디지털 포렌식 조사 절차와 방법이 필요하다. 본 논문에서는 디지털 포렌식 관점에서의 클라우드 컴퓨팅에 대해 설명한다. 또한 클라우드 포렌식 기술 동향과 클라우드 컴퓨팅 환경에서 발생하는 법적 이슈 동향을 살펴본다. 이를 바탕으로 향후 클라우드 컴퓨팅 포렌식 연구 방향에 대해서 제시한다.

• Annual Conference of KIPS
• /
• 2017.04a
• /
• pp.302-305
• /
• 2017

최근 시간과 장소에 얽매이지 않고, 언제 어디서나 편리하게 근무함으로써 업무효율성을 향상시킬 수 있는 업무환경 개념인 스마트워크(Smartwork)가 각광을 받고 있다. 그러나 스마트워크 환경에서는 모든 업무가 정보통신망과 정보시스템을 통해 처리되기 때문에 정보유출 위협이 존재한다. 또한, 디지털 포렌식 분야에서 조사 및 수사대상이 점점 다양화되고 있다. 내부정보 유출과 같은 보안사고 발생 후, 디지털 증거는 대부분 제한적으로 수집될 수밖에 없으며, 전문업체 의뢰 시 높은 의뢰비용과 장기간의 분석 시간이 소요된다. 기존의 내부정보 유출 방지 시스템에만 의존할 것이 아니라, 유출 행위 탐지에 중점을 둔 선제적 감사 활동을 수행하기 위한 디지털 포렌식 준비도가 필요한 상황이다. 따라서, 본 논문에서는 다양한 디지털 포렌식 준비도 관련 모델들에 대한 분석을 기반으로 미래 스마트워크 환경에서 보안사고에 대응하기 위한 디지털 포렌식 준비도 모형을 연구하였다.

• Annual Conference of KIPS
• /
• 2011.11a
• /
• pp.850-853
• /
• 2011

HPA(Host Protected Area) 영역과 DCO(Device Configuration Overlay) 영역은 사용자가 일반적으로 접근할 수 없는 영역이며 이 위치에 데이터를 저장하거나 은닉할 수 있다. HPA/DCO 영역은 저장 장치와의 통신을 위해 만들어진 규약인 ATA-4와 ATA-6에서 제시되었다. 디지털 포렌식 조사시 HPA/DCO 영역을 고려하지 않은 디스크 이미징 및 데이터 추출 방법은 해당 영역에 숨겨진 유용한 정보를 획득할 수 없다. 따라서 디지털 포렌식 관점에서 HPA/DCO 영역은 중요한 의미를 가지고 있으며, 해당 영역에 존재하는 데이터를 인식하여 획득하는 절차를 통해 디스크 이미징 또는 데이터 추출이 이루어져야 한다. 본 논문은 HPA/DCO 영역에 관한 기존 연구를 활용하여 포렌식 조사에서 해당 영역을 확인하고 접근할 수 있는 방법을 제시하며, HPA/DCO 영역에 저장되어 있는 데이터를 획득하여 디지털 포렌식 조사시 활용할 수 있도록 한다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.24 no.1
• /
• pp.135-144
• /
• 2014

Since anti-forensics have been developed in order to avoid digital forensic investigation, the forensic methods for analyzing anti-forensic behaviors have been studied in various aspects. Among the factors for user activity analysis, "Iconcache.db" files, which have the icon information of applications, provides meaningful information for digital forensic investigation. This paper illustrates the features of IconCache.db files and suggests the countermeasures against anti-forensics utilizing them.

• KIPS Transactions on Computer and Communication Systems
• /
• v.6 no.2
• /
• pp.95-104
• /
• 2017

As the technology in smart device is growing and Social Network Services(SNS) are becoming more common, the data which is difficult to be processed by existing RDBMS are increasing. As a result of this, NoSQL databases are getting popular as an alternative for processing massive and unstructured data generated in real time. The demand for the technique of digital investigation of NoSQL databases is increasing as the businesses introducing NoSQL database in their system are increasing, although the technique of digital investigation of databases has been researched centered on RDMBS. New techniques of digital forensic investigation are needed as NoSQL Database has no schema to normalize and the storage method differs depending on the type of database and operation environment. Research on document-based database of NoSQL has been done but it is not applicable as itself to other types of NoSQL Database. Therefore, the way of operation and data model, grasp of operation environment, collection and analysis of artifacts and recovery technique of deleted data in HBase which is a NoSQL column-based database are presented in this paper. Also the proposed technique of digital forensic investigation to HBase is verified by an experimental scenario.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.33 no.4
• /
• pp.647-659
• /
• 2023

As digital evidence becomes more important in criminal investigations, disputes are increasing in court. As media diversifies and the scope of analysis expands, the level of expertise in digital forensics is also increasing. However, no competency model has been developed to define the capabilities of digital evidence examiners or to judge their expertise. There have been some studies that have derived the capabilities necessary for digital evidence examiner, but they are still insufficient. Therefore, in this study, 25 competency evaluation factors in a total of 9 competency groups were defined using methodologies such as expert FGI and Delphi survey. Specifically, it was defined as Digital Forensics Theory, Digital Evidence Collection&Management, Disk Forensics, Mobile Forensics, Video Forensics, infringement forensics, DB Forensics, Embedded(IoT) Forensics, and Cloud Forensics. The digital evidence examiner competency model is expected to be used in various fields such as recruitment, education and training, and performance evaluation in the future.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.24 no.12
• /
• pp.1662-1669
• /
• 2020

Google cloud includes data uploaded and synchronized by users, as well as synchronization history of all cloud services, users' smartphone usage, and location information. Therefore, Google cloud data can be useful for digital forensics from a user behavior analysis perspective. Through this paper, we have identified the types of cloud data that can be acquired using Google's Takeout service and developed a tool that can be usefully utilized in digital forensics research and investigation by screening and analyzing the data required for analyzing user behavior. Because Google cloud data is synchronized through Google accounts regardless of the type of computing device, Google service data used on various devices such as PCs, smartphones, and tablet PCs can be acquired through Google accounts without the device. Therefore, the results of this paper's research are expected to be very useful for digital forensics research and investigation in the current situation.

• The Journal of the Institute of Internet, Broadcasting and Communication
• /
• v.19 no.6
• /
• pp.15-20
• /
• 2019

Fundamental processes in digital forensic investigation - such as disk imaging - were developed when digital investigation was relatively young. As digital forensic processes and procedures matured, these fundamental tools, that are the pillars of the reset of the data processing and analysis phases of an investigation, largely stayed the same. This work is a study of modern digital forensic imaging software tools. Specifically, we will examine the feature sets of modern digital forensic imaging tools, as well as their development and release cycles to understand patterns of fundamental tool development. Based on this survey, we show the weakness in current digital investigation fundamental software development and maintenance over time. We also provide recommendations on how to improve fundamental tools.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.24 no.1
• /
• pp.123-134
• /
• 2014

As the data gets bigger recently, the demand for relational database management system (RDBMS) and NoSQL DBMS to process big data has been increased consistently. The digital forensic investigation method for RDBMS has been studied actively, but that for NoSQL DBMS, which is popularly used nowadays, has almost no research. This paper proposes the digital forensic investigation process and method for MongoDB, the most popularly used among NoSQL DBMS.

• Journal of Convergence for Information Technology
• /
• v.10 no.5
• /
• pp.23-29
• /
• 2020

These days, digital forensic technologies are being used frequently at crime scenes. There are various electronic devices at the scene of the crime, and digital forensic results of these devices are used as important evidence. In particular, the user's action and the time when the action took place are critical. But there are many limitations for use in real forensics analyses because of the short cycle in which user actions are recorded. This paper proposed an efficient method for recovering deleted user behavior records and applying them to forensics investigations, then the proposed method is compared with previous methods. Although there are difference in recovery result depending on the storage, the results have been identified that the amount of user history data is increased from a minimum of 6% to a maximum of 539% when recovered user behavior was utilized to forensics investigation.