• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.32 no.1
• /
• pp.77-88
• /
• 2022

With the development and popularization of drone manufacturing technology, the drone market, which was mainly focused on industry, agriculture, and military, is also showing great growth in individual and commercial markets. Among them, DJI has a high share in the personal and commercial drone market, and accordingly, forensic analysis of DJI drones is drawing attention. In particular, when stealing and analyzing drones used in criminal acts, a technology to interpret flight logs recording drone flight paths and hardware information is needed, which inevitably applies drone models due to differences in decryption methods. Therefore, when an unidentified drone is acquired from the perspective of a digital forensic investigator, a clear classification of a drone model to which analysis can be applied is required. This paper proposes a method of extracting and analyzing artifacts of DJI drones through forensics, and analyzes media data analysis and flight log analysis results and decryption methods for three drone models with different release years of DJI. Finally, drones in the DJI product line are classified according to whether the commercialized DJI drone flight log is decrypted.

• Proceedings of the Korean Society of Broadcast Engineers Conference
• /
• 2008.02a
• /
• pp.155-158
• /
• 2008

기술이 발전함에 따라 컴퓨터 범죄는 점차 증가하고 있으며, 용의자는 사건의 증거가 될 수 있는 파일들에 대해 패스워드 기능을 제공하는 응용프로그램을 활용하여 증거물에 대해 의도적인 접근을 막고 있다. 이로 인해 수사관은 암호화된 파일들에 대해 접근이 매우 어려운 상황이며, 해결 방안으로써 패스워드 복구 프로그램이 대안이 될 수 있다. 하지만 대다수의 패스워드 복구 프로그램들은 단순한 전수조사 공격 방식을 지원하거나 국가별 특징을 고려하지 않은 영문용 사전파일을 적용하여 복구하고 있기 때문에, 국내수사 환경에서 패스워드 검색에 한계가 따르고 있다. 따라서 수사관이 암호화된 파일에 대해 효율적으로 검색할 수 있는 방안이 필요하며, 이를 통해 빠른 시간 내에 증거물을 복구할 수 있는 방안이 강구되어야 한다. 본 논문에서는 최근 국내외 사전구축 사례 및 동향을 조사함으로써 효율적인 패스워드 사전 파일을 구축할 수 있는 방안을 제시하며, 이와 함께 용의자의 개인적인 정보를 이용하여 최적화된 사전파일을 생성할 수 있는 방안에 대해 설명한다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.21 no.3
• /
• pp.143-154
• /
• 2011

SQLite is a small sized database engine largely used in embedded devices and local application software. The availability of portable devices, such as smartphones, has been extended over the recent years and has contributed to growing adaptation of SQLite. This implies a high likelihood of digital evidences acquired during forensic investigations to include SQLite database files. Where intentional deletion of sensitive data can be made by a suspect, forensic investigators need to recover deleted records in SQLite at the best possible. This study analyzes data management rules used by SQLite and the structure of deleted data in the system, and in turn suggests a recovery Tool of deleted data. Further, the study examines major SQLite suited software as it validates feasible possibility of deleted data recovery.

• KIPS Transactions on Computer and Communication Systems
• /
• v.6 no.7
• /
• pp.307-314
• /
• 2017

Stick-PC is small and portable, So it can be used like a desktop if you connect it to a display device such as a monitor or TV anytime and anywhere. Accordingly, Stick-PC can related to various crimes, and various evidence may remain. Stick-PC uses the same Windows version of the operating system as the regular Desktop, the artifacts to be analyzed are the same. However, unlike the Desktop, it can be used as a meaningful information for forensic investigation if it is possible to identify the actual user and trace the usage by finding the traces of peripheral devices before analyzing the system due to the mobility. In this paper, We presents a method of collecting images using Bootable OS, which is one of the image collection methods of Stick-PC. In addition, we show how to analyze the trace of peripheral connection and network connection trace such as Display, Bluetooth through the registry and event log, and suggest the application method from the forensic point of view through experimental scenario.

• The Journal of the Institute of Internet, Broadcasting and Communication
• /
• v.16 no.3
• /
• pp.21-28
• /
• 2016

File Time information has a significant meaning in digital forensic investigation. File time information in Linux Ext4 (Extended File System 4) environment is the Access Time, Modification Time, Inode Change Time, Deletion Time and Creation Time. File time is variously changed by user manipulations such as creation, copy and edit. And, the study of file time change is necessary for evidence analysis. This study analyzes the change in time information of files or folders resulting from user manipulations in Linux operating system and analyzes ways to determine real time of malware infection and whether the file was modulation.

• The Journal of Society for e-Business Studies
• /
• v.23 no.3
• /
• pp.129-143
• /
• 2018

Recently, the use of digital media such as computers and smart devices has been rapidly increasing, The vast and diverse information contained in the warrant of the investigating agency also includes the one irrelevant to the crime. Therefore, when confiscating the information, the basic rights, defense rights and privacy invasion of the person to be seized have been the center of criticism. Although the investigation agency guarantees the right to participate, it does not have specific guidelines, so they are various by the contexts and environments. In this process, the abuse of the participation right is detrimental to the speed and integrity of the investigation, and there is a side effect that the digital evidence might be destroyed by remote initialization. In this study, we conducted surveys of digital evidence analysts across the country based on four domains and thirty measurement items for enabling environment for participation in information storage media export and digital evidence search process. The difference between the level of importance and the performance was analyzed by the IPA matrix based on process, location, people, and technology dimensions. Seven items belonging to "concentrate here" area are one process-related, three location-related, and three people-related items. This study is meaningful to be a basis for establishing the proper policies and strategies for ensuring participation right, as well as for minimizing the side effects.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.27 no.2
• /
• pp.223-232
• /
• 2017

Previous research on data recovery in Microsoft SQL Server has focused on restoring data based on in the transaction log that might have deleted records exist. However, there was a limit that was not applicable if the related transaction log did not exist or the physical database file was not connected to Server. Since the suspect in the crime scene may delete the data records using a different deletion statements besides "delete", we need to check the remaining data and a recovery possibility of the deleted record. In this paper, we examined the changes "Page Allocation information" of the table, "Unallocation deleted data", "Row Offset Array" in the page according to "delete", "truncate" and "drop" events. Finally it confirmed the possibility of data recovery and availability of management tools in Microsoft SQL Server digital forensic investigation.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.28 no.4
• /
• pp.859-868
• /
• 2018

Previous research related to recovering deleted data in database has been mainly based on transaction logs or detecting and recovering data using original source files by physical collection method. However there was a limit to apply if the transaction log does not exist in the server or it is not possible to collect the original source file because a database server owner does not permit stopping the database server because of their business loss or infringement at the scene. Therefore it is necessary to examine various collection methods and check the recoverability of the deleted data in order to handling the constraints of evidence collection situation. In this paper we have checked an experiment that the recoverability of deleted data in the original database source according to logical and physical collection methods on digital forensic investigation of Microsoft SQL Server database.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.33 no.5
• /
• pp.753-760
• /
• 2023

KakaoTalk has the highest market share among domestic messengers. As such, KakaoTalk's conversation content is an important evidence in digital forensics, and the conversation is stored in the form of an encrypted database on a user's device. In addition, macOS has the characteristic that it is difficult to access because the disk encryption function is basically activated. The decryption method of the KakaoTalk database for Windows has been studied, but the decryption method has not been studied for KakaoTalk for macOS. In this paper, research the decryption method of the KakaoTalk database for macOS and a way to Brute-Force plan using the characteristics of KakaoTalk's UserID and compare it with KakaoTalk for Windows to examine the commonalities and differences. The results of this paper are expected to be used to analyze users' actions and events when investigating crimes using macOS.

• Journal of Arbitration Studies
• /
• v.32 no.4
• /
• pp.53-85
• /
• 2022

Small and medium-sized enterprises ("SMEs") are vulnerable to trade secret misappropriation. Korea's legislation for the protection of SMEs' trade secrets and provision of civil, criminal, and administrative remedies includes the SME Technology Protection Act, the Unfair Competition Prevention Act, the Industrial Technology Protection Act, the Mutually Beneficial Cooperation Act, and the Subcontracting Act. Among these acts, the revised SME Technology Protection Act of 2018 introduced the "administrative technology misappropriation investigation system" to facilitate a rapid resolution of SMEs' technology misappropriation disputes. On September 27, 2021, Korea's Ministry of SMEs announced that it had reached an agreement to resolve the dispute between Hyundai Heavy Industries and Samyeong Machinery through the administrative technology misappropriation investigation system. However, not until 3 years and a few months passed since the introduction of the system could it be used to resolve an SME's technology misappropriation dispute with a large corporation. So there arose a question on the usefulness of the system. Therefore, we conducted a comparative legal analysis of Korea's laws enacted to protect trade secrets of SMEs and to address technology misappropriation, focusing on their legislative purpose, protected subject matter, types of misappropriation, and legal remedies. Then we analyzed the administrative technology misappropriation investigation system and the cases where this system was applied. We developed a proposal to enhance the usefulness of the system. The expert interviews of 4 attorneys who are experienced in the management of the system to check the practical value of the proposal. Our analysis shows that the lack of compulsory investigation and criminal sanctions is the fundamental limitation of the system. We propose revising the SME Technology Protection Act to provide correction orders, criminal sanctions, and compulsory investigation. We also propose training professional workforces to conduct digital forensics, enabling terminated SMEs to utilize the system, and assuring independence and fairness of the mediation and arbitration of the technology misappropriation disputes.