• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.18 no.4
• /
• pp.779-789
• /
• 2014

A number of universities around the world provide various undergraduate and graduate programs for digital forensic. In this paper, we propose a cross-layer program suitable for senior students in the IT and law departments to learn multi-disciplinary convergence subjects. We have first analyzed the key ingredients of digital forensic and then the current programs in several universities. After describing the qualifications anticipated for digital forensic specialists, we have critically analyzed the courses currently offered in the IT and law departments. Based on the analysis and discussions, we have proposed an IT+law program and two flexible operation schemes of the program for securing the desired level of convergence education.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.24 no.12
• /
• pp.1662-1669
• /
• 2020

Google cloud includes data uploaded and synchronized by users, as well as synchronization history of all cloud services, users' smartphone usage, and location information. Therefore, Google cloud data can be useful for digital forensics from a user behavior analysis perspective. Through this paper, we have identified the types of cloud data that can be acquired using Google's Takeout service and developed a tool that can be usefully utilized in digital forensics research and investigation by screening and analyzing the data required for analyzing user behavior. Because Google cloud data is synchronized through Google accounts regardless of the type of computing device, Google service data used on various devices such as PCs, smartphones, and tablet PCs can be acquired through Google accounts without the device. Therefore, the results of this paper's research are expected to be very useful for digital forensics research and investigation in the current situation.

• Convergence Security Journal
• /
• v.23 no.1
• /
• pp.97-107
• /
• 2023

With the popularization of digital devices in the era of the 4th industrial revolution and the increase in cyber crimes targeting them, the importance of securing digital data evidence is emerging. However, the difficulty in securing digital data evidence is due to the use of anti-forensic techniques that increase analysis time or make it impossible, such as manipulation, deletion, and obfuscation of digital data. Such anti-forensic is defined as a series of actions to damage and block evidence in terms of digital forensics, and is classified into data destruction, data encryption, data concealment, and data tampering as anti-forensic techniques. Therefore, in this study, anti-forensic techniques are categorized into data concealment and deletion (obfuscation and encryption), investigate and analyze recent research trends, and suggest future anti-forensic research directions.

• Proceedings of the Korean Information Science Society Conference
• /
• 2012.06c
• /
• pp.75-77
• /
• 2012

플래시 메모리가 각종 IT 기기의 저장장치로 많이 사용되면서 범죄 관련 증거나 단서가 기기 내에 저장되는 경우가 증가하고 있다. 이러한 경우에 기기 내에 저장된 데이터를 완전히 삭제하기 위하여 안티 포렌식 기술인 와이핑 기법을 사용하는데 이에 대응하기 위해서는 플래시 메모리에 저장된 디지털 증거를 분석하기 위한 디지털 포렌식 기술이 필요하다. 플래시 메모리에 저장되어 있는 데이터를 복구하는 기법이 연구되었으나 특정한 상황을 가정한 특정 파일의 복원에 초점을 두고 있다. 하지만 디지털 포렌식 수사에서 범죄 증거뿐만 아니라 범죄 행위에 관련한 증거도 확보할 필요성이 있지만 이와 같은 연구가 미흡하다. 본 논문은 플래시 메모리에서 안티 포렌식 기술인 파일 와이핑으로 삭제된 파일에 대한 와이핑 증거 확보 기법을 제안한다. 제안 내용은 장치 내의 원본파일과 와이핑 파일로 추정되는 블록들을 검색한 후 갱신시각, 파일에 대한 정보를 통해 서로 비교하여 검증한다.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2011.11a
• /
• pp.850-853
• /
• 2011

HPA(Host Protected Area) 영역과 DCO(Device Configuration Overlay) 영역은 사용자가 일반적으로 접근할 수 없는 영역이며 이 위치에 데이터를 저장하거나 은닉할 수 있다. HPA/DCO 영역은 저장 장치와의 통신을 위해 만들어진 규약인 ATA-4와 ATA-6에서 제시되었다. 디지털 포렌식 조사시 HPA/DCO 영역을 고려하지 않은 디스크 이미징 및 데이터 추출 방법은 해당 영역에 숨겨진 유용한 정보를 획득할 수 없다. 따라서 디지털 포렌식 관점에서 HPA/DCO 영역은 중요한 의미를 가지고 있으며, 해당 영역에 존재하는 데이터를 인식하여 획득하는 절차를 통해 디스크 이미징 또는 데이터 추출이 이루어져야 한다. 본 논문은 HPA/DCO 영역에 관한 기존 연구를 활용하여 포렌식 조사에서 해당 영역을 확인하고 접근할 수 있는 방법을 제시하며, HPA/DCO 영역에 저장되어 있는 데이터를 획득하여 디지털 포렌식 조사시 활용할 수 있도록 한다.

• Information Systems Review
• /
• v.19 no.2
• /
• pp.185-209
• /
• 2017

In modern society, crime records have been digitized. Digital information is difficult to distinguish from original information, but the former is easy to modulate. This situation explains the increasing importance of digital forensics. However, digital forensic has several inefficiencies because of the rapid development of technology, unclear jurisdiction, and tool errors. This study surveyed digital forensic specialists and derived the priority of domestic digital forensic issues by redefining 17 issues in digital forensics from Brungs-Jamieson study in Australia. The present study was divided into four groups, namely, police, government and public corporations, private companies, and legal groups. The study could compare and analyze comparative analysis of existing studies in Australia and the US. This study can also examine differences in the results of each group in Korea. Thus, the key issues in Korea were derived as "Requirements to 'Fire Up' Original." The differences of the three groups in terms of legal issues were then identified. This finding enables us to understand differences in priorities and importance between groups and countries.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2010.10a
• /
• pp.235-239
• /
• 2010

Use of mobile phones reached saturation point, the recent use of the iPhone, including the Smart Phone is increasing rapidly. How to extract forensic data from current mobile phones and SYN, JTAG, Revolving There are three ways. Mobile phone and Smart Phone, but the technology and how to use forensic data because of the difference must have different extraction methods. In this paper, in the Smart Phone will study how to extract forensic data. Commonly used in the Google Android Smart Phone and Windows Mobile Smart Phone OS in the specification and analysis for analysis, the data analysis. Also, Google Android and Windows Mobile Smart Phone to extract forensic data to generate evidence. The present study tested the Mobile Smart Phone technology research will contribute to the development of forensic techniques.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2017.04a
• /
• pp.273-275
• /
• 2017

드론 기술이 발전하여 다양한 용도로 활용 가능해지면서 사용 범위와 시장을 더욱 넓혀가고 있다. 또한 사물인터넷(IoT) 시대에 포렌식 적용 대상의 범위가 스마트 워치, 스마트 TV 등 우리 생활에 다양하게 자리잡은 임베디드 시스템으로 확대되고 있다. 본 논문에서는 리눅스 포렌식 아티팩트 분석 기법을 이용하여 Busybox를 사용하는 드론에 대해 중요 데이터 증거를 수집하는 방법을 제시한다.

• Convergence Security Journal
• /
• v.17 no.2
• /
• pp.23-32
• /
• 2017

With the development of information and communication technology, various data including digital data have increased exponentially. In a society where such data utilization is generalized, criminal investigation processes and trial processes have also been influenced. However, in comparison with the progress of the technical capability and analytical capability of digital certification which is increasing exponentially, the establishment of the digital forensic related legal system is still in short supply. Therefore, it is necessary to activate balanced research for legal recognition of digital certification. Therefore, in this research, meta analysis was conducted to grasp trends of research related to digital forensics and to provide objective data for research revitalization.

• KIPS Transactions on Computer and Communication Systems
• /
• v.6 no.2
• /
• pp.95-104
• /
• 2017

As the technology in smart device is growing and Social Network Services(SNS) are becoming more common, the data which is difficult to be processed by existing RDBMS are increasing. As a result of this, NoSQL databases are getting popular as an alternative for processing massive and unstructured data generated in real time. The demand for the technique of digital investigation of NoSQL databases is increasing as the businesses introducing NoSQL database in their system are increasing, although the technique of digital investigation of databases has been researched centered on RDMBS. New techniques of digital forensic investigation are needed as NoSQL Database has no schema to normalize and the storage method differs depending on the type of database and operation environment. Research on document-based database of NoSQL has been done but it is not applicable as itself to other types of NoSQL Database. Therefore, the way of operation and data model, grasp of operation environment, collection and analysis of artifacts and recovery technique of deleted data in HBase which is a NoSQL column-based database are presented in this paper. Also the proposed technique of digital forensic investigation to HBase is verified by an experimental scenario.