• Proceedings of the Korean Society of Broadcast Engineers Conference
• /
• 2008.02a
• /
• pp.155-158
• /
• 2008

기술이 발전함에 따라 컴퓨터 범죄는 점차 증가하고 있으며, 용의자는 사건의 증거가 될 수 있는 파일들에 대해 패스워드 기능을 제공하는 응용프로그램을 활용하여 증거물에 대해 의도적인 접근을 막고 있다. 이로 인해 수사관은 암호화된 파일들에 대해 접근이 매우 어려운 상황이며, 해결 방안으로써 패스워드 복구 프로그램이 대안이 될 수 있다. 하지만 대다수의 패스워드 복구 프로그램들은 단순한 전수조사 공격 방식을 지원하거나 국가별 특징을 고려하지 않은 영문용 사전파일을 적용하여 복구하고 있기 때문에, 국내수사 환경에서 패스워드 검색에 한계가 따르고 있다. 따라서 수사관이 암호화된 파일에 대해 효율적으로 검색할 수 있는 방안이 필요하며, 이를 통해 빠른 시간 내에 증거물을 복구할 수 있는 방안이 강구되어야 한다. 본 논문에서는 최근 국내외 사전구축 사례 및 동향을 조사함으로써 효율적인 패스워드 사전 파일을 구축할 수 있는 방안을 제시하며, 이와 함께 용의자의 개인적인 정보를 이용하여 최적화된 사전파일을 생성할 수 있는 방안에 대해 설명한다.

• Journal of Korea Multimedia Society
• /
• v.10 no.3
• /
• pp.365-372
• /
• 2007

The information of world is most likely to be created as digital data. These digital productions need some legal protection mechanisms or techniques because users can illegally use them. Thus many researchers are developing various techniques. Currently most techniques are focusing on the physical and chemical methods like disk inspection for taking legal evidence about production infringement. This paper has developed a computer forensics-based copyrights protection system capable of detecting and notifying disobedience facts when user uses illegally a production. Furthermore if the user infringes continually the production the system stores the infringement facts to take the legal evidence by mapping to law for intellectual property right. The technique can protect data from digital evidence manipulation or destruction.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2013.05a
• /
• pp.101-103
• /
• 2013

Most pickpockets occurs at a place where a lot of people. However, the current occurs more commonly in a secluded place and unfrequented place. In this paper, we classified to the scene for submitting to image forensics evidence target for pickpockets of theft. Using the ${\chi}^2$ histogram to detect the scene change detection. We wish to submit evidence by classifying as a pickpocket scene video.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.25 no.3
• /
• pp.595-602
• /
• 2015

One of the challenges of the digital forensics is how to handle certain amounts of data efficiently. Although reliable and various approximate matching algorithms have been presented to quickly identify similarities between digital objects, its practical effectiveness to identify the semantic similarity is low because of frequent false positives. To solve this problem, we suggest adding a pre-processing of the approximate matching target dataset to increase matching accuracy while maintaining the reliability of the approximate matching algorithm. To verify the effectiveness, we experimented with two datasets of eml and hwp using sdhash in order to identify the semantic similarity.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.28 no.4
• /
• pp.839-845
• /
• 2018

Sensitive data is encrypted and stored as privacy policy is strengthened through frequent leakage of personal information. For this reason, the cryptographically owned encrypted data is a very important analysis from the viewpoint of digital forensics. Until now, the digital evidence collection procedure only considers imaging, so hardware specific information is not collected. If the encryption key is generated by information that is not left in the disk image, the encrypted data can not be decrypted. Recently, an application for performing encryption using hardware specific information has appeared. Therefore, in this paper, hardware specific information which does not remain in file form in auxiliary storage device is studied, and hardware specific information collection method is introduced.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.26 no.5
• /
• pp.1131-1139
• /
• 2016

In the Hive file format, the sk(Security Key) cell provides access control to registry key. An attacker can figure out secret information on registry or change the security set-up if she could apply modified hive files on system. This paper presents various methods to change access control of registry key by modifying or replacing cell on hive file. We also discuss threats by access control modification and signs of attacks analysis by modified hive files.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.21 no.6
• /
• pp.45-54
• /
• 2011

Corporations use e-mail as their primary method for internal communication and business processes. By their nature, the e-mails are in general used for major business processes that contain large amounts of business information. When there is a critical event, such as Technology leakage, an e-mail message can become important evidence. However, as there is a high likelihood that a suspect will intentionally erase an e-mail message, the ability to recover deleted e-mail is very important. This pater analyzes the deleted e-mail item structure in files of various e-mail clients, and explains the possibility and methods of recovery.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.22 no.6
• /
• pp.1363-1374
• /
• 2012

The number and use of Internet connected devices has dramatically increased in the last several years. Therefore many services synchronizing data in real-time is increasing such as mail, calendar and storage service. This service provides convenience to users. However, after devices are seized, the data could be changed because of characteristic about real-time synchronization. Therefore digital investigation could be difficult by this service. This work investigates the traces on each local device and proposes a method for the preservation of real-time synchronized data. Based on these, we propose the procedures of real-time synchronization data.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.20 no.5
• /
• pp.125-132
• /
• 2010

Web browser is essential application for using internet. If suspect use a web browser for crime, evidence related crime is stored in log file. Therefore, we obtain the useful information related crime as investigating web browser log file. In this paper, we look at the related work and tools for web browser log file. And we introduce analysis methodology of web browser log file focus on the digital forensics. In addition, we apply to our tool at real case.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.33 no.6
• /
• pp.893-906
• /
• 2023

Awareness that smartphones can be used as tools for criminal activity is prevalent in many organizations, but the functionally smartphone-like smartwatch's potential as a criminal tool is being overlooked. Considering this situation, this research verifies the possibility of information leakage through an insider's smartwatch in a situation where smartphones are controlled by security regulations and technologies, but smart watch are not. By analyzing information related application usage and Wi-Fi connection generated in the smartwatch during the verification process, forensic information and limitations are identified. Finally, this research proposes preventive methods to prepare for potential smartwatch-related crimes, and reconsiders awareness of the possibility of using smartwatches as criminal tools.