• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.24 no.12
• /
• pp.1662-1669
• /
• 2020

Google cloud includes data uploaded and synchronized by users, as well as synchronization history of all cloud services, users' smartphone usage, and location information. Therefore, Google cloud data can be useful for digital forensics from a user behavior analysis perspective. Through this paper, we have identified the types of cloud data that can be acquired using Google's Takeout service and developed a tool that can be usefully utilized in digital forensics research and investigation by screening and analyzing the data required for analyzing user behavior. Because Google cloud data is synchronized through Google accounts regardless of the type of computing device, Google service data used on various devices such as PCs, smartphones, and tablet PCs can be acquired through Google accounts without the device. Therefore, the results of this paper's research are expected to be very useful for digital forensics research and investigation in the current situation.

• Journal of the Korea Society of Computer and Information
• /
• v.22 no.8
• /
• pp.73-83
• /
• 2017

In this paper, we discuss the differences between an ordinary B-tree and B-tree implemented by NTFS. There are lots of distinctions between the two B-tree, if not understand the distinctions fully, it is difficult to utilize and analyze artifacts of NTFS. Not much, actually, is known about the implementation of NTFS, especially B-tree index for directory management. Several items of B-tree features are performed that includes a node size, minimum number of children, root node without children, type of key, key sorting, type of pointer to child node, expansion and reduction of node, return of node. Furthermore, it is emphasized the fact that NTFS use B-tree structure not B+structure clearly.

• The Journal of Information Technology
• /
• v.10 no.4
• /
• pp.41-56
• /
• 2007

In Digital Computing Environment, volatile information such as register, cache memory, and network information are hard to make certain of a real-time collection because such volatile information are easily modified or disappeared. Thus, a collection of volatile information is one of important step for computer forensics system on ubiquitous computing. In this paper, we propose a volatile information collection module, which collects variable volatile information of server system based on memory mapping in real-time.

• Proceedings of the Korean Information Science Society Conference
• /
• 2012.06c
• /
• pp.245-247
• /
• 2012

We know that JPEG image format is one of the most popular image formats in the digital area and distribution of digital photographic drawing it is interested frequently in certain types of forensic investigation. In most case, corrupted images are shown gaudiness with the boundary of the corrupted parts. In the paper, we propose a technique to carve correct JPEG images using transformation method and the approach can be used for JPEG image file carving tool development.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2012.11a
• /
• pp.1333-1335
• /
• 2012

이 연구에서는 전자기록물의 일반적인 특징과 법적 증거능력에 대해서 조사하고 이를 통해 국가기록원을 비롯한 기록보존소에서 관리하는 전자기록들의 증거능력에 대해 고찰하였다. 또한 디지털 증거를 수집 분석하여 법정에 제출하기 위한 분야인 디지털 포렌식(Digital Forensics)에서의 절차 및 기술을 통해 전자기록관리 프로세스에서 전자기록의 증거능력을 확보하기 위한 기초적인 방안을 제시한다.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2007.11a
• /
• pp.298-299
• /
• 2007

웹 서버에서 로그파일은 웹 서버에 대한 접속정보를 저장한다. 이 정보를 분석하면 웹 서비스를 하는데 있어서 서비스의 질을 높이는데 좋은 참고자료가 될 뿐 아니라 웹 서버에 이상이 생겼을 경우 발생한 오류를 조기에 발견하는 데에도 사용되는 중요한 자료이다. 현재 이러한 로그파일은 텍스트 파일로 저장이 되어있으며 오랜 시간이 지나 그 웹 페이지가 삭제되었을 경우 로그파일에 기록된 그 시각의 웹 페이지를 찾아보기가 어렵다. 본 연구에서는 로그파일에 기록된 그 시각의 웹 페이지의 이미지를 저장하는 방법으로 이러한 단점을 보안하고 오랜 시간이 지난 후에도 그 웹 페이지를 볼 수 있는 방법을 제안한다. 이 아이디어가 구현되어 실현되면 또한 Digital Forensic 으로써 범죄 수사에도 많은 도움이 될뿐만 아니라 휴대전화로 풀 인터넷 브라우징이 가능한 풀브라우저에도 적용될 수 있다.

• Proceedings of the Korean Society of Computer Information Conference
• /
• 2021.07a
• /
• pp.215-218
• /
• 2021

심캐시(Shimcache, AppCompatCache) 파일은 Windows 운영체제에서 응용 어플리케이션 간의 운영체제 버전 호환성 이슈를 관리하는 파일이다. 호환성 문제가 발생한 응용 어플리케이션에 대한 정보가 심캐시에 기록되며 프리패치 (Prefetch) 파일이나 레지스트리의 UserAssist 키 등과 같이 응용 어플리케이션의 실행 흔적을 기록한다는 점에서 포렌식적 관점에서 중요한 아티팩트이다. 본 논문에서는 심캐시의 구조를 분석하여 심캐시 파일을 통해 얻을 수 있는 응용 어플리케이션의 정보를 소개하고, 기존 툴 상용도구의 개선을 통해 완전 삭제 등 안티 포렌식 도구의 실행 흔적을 탐지하는 방법을 제시한다.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.10 no.8
• /
• pp.3943-3957
• /
• 2016

As digital evidence has a highly influential role in proving the innocence of suspects, methods for integrity verification of such digital evidence have become essential in the digital forensic field. Most surveillance camera systems are not equipped with proper built-in integrity protection functions. Because digital forgery techniques are becoming increasingly sophisticated, manually determining whether digital content has been falsified is becoming extremely difficult for investigators. Hence, systematic approaches to forensic integrity verification are essential for ascertaining truth or falsehood. We propose an integrity determination method that utilizes the structure of the video content in a Video Event Data Recorder (VEDR). The proposed method identifies the difference in frame index fields between a forged file and an original file. Experiments conducted using real VEDRs in the market and video files forged by a video editing tool demonstrate that the proposed integrity verification scheme can detect broken integrity in video content.

• Proceedings of the IEEK Conference
• /
• 2006.06a
• /
• pp.33-34
• /
• 2006

Computer Forensics is a research area which finds the malicious users by collecting and analyzing the intrusion or infringement evidence of the computer crime. Many research about Computer Forensics has been done. But those research have focussed on how to collect the evidence after receiving the damage reports from computer users or network administrators. This paper describes about collecting the evidence of good quality at the time of infringement occurrence by the malicious user. By calculating Infringement severity of observable and protective hosts and referring to this value, we collect the evidence at the time of infringement occurrence to minimize the information modification of the evidence. We can reduce also the amount of logs that we use to analyze the infringement and can minimize the loss of the evidence.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.13 no.6
• /
• pp.3258-3279
• /
• 2019

Recently, ransomware has earned itself an infamous reputation as a force to reckon with in the cybercrime landscape. However, cybercriminals are adopting other unconventional means to seamlessly attain proceeds of cybercrime with little effort. Cybercriminals are now acquiring cryptocurrencies directly from benign Internet users without the need to extort a ransom from them, as is the case with ransomware. This paper investigates advances in the cryptovirology landscape by examining the state-of-the-art cryptoviral attacks. In our approach, we perform digital autopsy on the malware's source code and execute the different malware variants in a contained sandbox to deduce static and dynamic properties respectively. We examine three cryptoviral attack structures: browser-based crypto mining, memory resident crypto mining and cryptoviral extortion. These attack structures leave a trail of digital forensics evidence when the malware interacts with the file system and generates noise in form of network traffic when communicating with the C2 servers and crypto mining pools. The digital forensics evidence, which essentially are IOCs include network artifacts such as C2 server domains, IPs and cryptographic hash values of the downloaded files apart from the malware hash values. Such evidence can be used as seed into intrusion detection systems for mitigation purposes.