• Journal of Advanced Navigation Technology
• /
• v.15 no.5
• /
• pp.887-892
• /
• 2011

Recently iPad has been released, so users interest in new portable device is increasing. As markets grow, experts are forecasting a increase of investigation about tablet PC. However iPad forensics is very difficult using existing smart phone forensic softwares. especially, those softwares can't analyze korean mobile application. This paper describes collecting/analyzing technique for iPad.

• KIPS Transactions on Computer and Communication Systems
• /
• v.2 no.1
• /
• pp.43-50
• /
• 2013

File identification and analysis is an important process of computer forensics, since the process determines which subjects are necessary to be collected and analyzed as digital evidence. An efficient file classification aids in the file identification, especially in case of copyright infringement where we often have huge amounts of files. A lot of file classification methods have been proposed by far, but they have mostly focused on classifying malicious behaviors based on known information. In copyright infringement cases, we need a different approach since our subject includes not only malicious codes, but also vast number of normal files. In this paper, we propose an efficient file classification method that relies on undocumented information in the header of the PE format files. Out method is useful in copyright infringement cases, being applied to any sort of PE format executable file whether the file is malicious, packed, mutated, transformed, virtualized, obfuscated, or not.

• KIPS Transactions on Computer and Communication Systems
• /
• v.2 no.6
• /
• pp.279-290
• /
• 2013

In digital forensics log files have been stored as a form of large data for the purpose of tracing users' past behaviors. It is difficult for investigators to manually analysis the large log data without clues. In this paper, we propose a text mining technique for extracting intrusion logs from a large log set to recommend reliable evidences to investigators. In the training stage, the proposed method extracts intrusion association words from a training log set by using Apriori algorithm after preprocessing and the probability of intrusion for association words are computed by combining support and confidence. Robinson's method of computing confidences for filtering spam mails is applied to extracting intrusion logs in the proposed method. As the results, the association word knowledge base is constructed by including the weights of the probability of intrusion for association words to improve the accuracy. In the test stage, the probability of intrusion logs and the probability of normal logs in a test log set are computed by Fisher's inverse chi-square classification algorithm based on the association word knowledge base respectively and intrusion logs are extracted from combining the results. Then, the intrusion logs are recommended to investigators. The proposed method uses a training method of clearly analyzing the meaning of data from an unstructured large log data. As the results, it complements the problem of reduction in accuracy caused by data ambiguity. In addition, the proposed method recommends intrusion logs by using Fisher's inverse chi-square classification algorithm. So, it reduces the rate of false positive(FP) and decreases in laborious effort to extract evidences manually.

• Proceedings of the Korea Multimedia Society Conference
• /
• 2012.05a
• /
• pp.231-233
• /
• 2012

컴퓨터 및 프린터 기술의 발전으로 디지털 문서 활용 사례가 전 분야에 확산되면서 디지털 문서의 위 변조 범죄가 증가하고 많은 사회적인 문제를 야기하고 있다. 이러한 컴퓨터를 이용한 범죄의 증거를 수집하고 분석하기 위해 디지털 포렌식 기술의 발전이 더욱 중요해지고 있다. 디지털 포렌식은 PC나 휴대폰 등 각종 디지털 매체 등에 남아 있는 디지털 정보들을 수집 분석해 범죄 단서를 찾는 컴퓨터 법의학이다. 본 논문에서는 프린터기로 출력된 문서의 고해상도 영상현미경 이미지를 사용하여 원본 여부를 판별 할 수 있는 프린터기 동일 여부 판별 기술을 제안한다.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2008.05a
• /
• pp.679-682
• /
• 2008

기존의 웹서버는 텍스트형식의 로그파일을 기록한다. 웹 서버에서 로그파일은 클라이언트의 웹서버에 대한 접속정보와 웹서버의 처리상황 등 모든 상황을 기록하고 저장한다. 이 정보를 분석하면 웹 서비스를 하는데 있어서 웹 서비스의 질을 높이는데 좋은 참고자료가 될 뿐 아니라 웹 서버에 이상이 생겼을 경우 발생한 오류를 조기에 발견하는 데에도 사용되는 중요한 자료이다. 현재 이러한 로그파일은 텍스트 파일로 저장되어있기 때문에 조작의 가능성도 있고 오랜 시간이 지나 해당 웹 페이지가 삭제되었을 경우 로그파일에 기록된 그 시각의 웹 페이지를 볼 수 없다. 본 연구에서는 로그파일에 기록된 그 시간의 웹 URL 페이지 이미지를 저장하여 이미지 로그파일을 만드는 시스템을 구현해 봄으로써 텍스트형식 로그파일의 단점을 보안하고 오랜 시간이 지난 후에도 그 웹 페이지를 볼 수 있는 기법을 연구하였다. 이 기법은 로그파일로써의 역할 뿐만 아니라 Digital Forensics 로 범죄 수사에도 많은 도움이 될 수 있고 휴대전화에서 풀 인터넷 브라우징 연구에도 적용될 수 있다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.21 no.2
• /
• pp.61-70
• /
• 2011

Virtualization is a technology that uses a logical environment to overcome physical limitations in hardware. As a part of cost savings and green IT policies, there is a tendency in which recent businesses increase the adoption of such virtualization. In particular, regarding the virtualization in desktop, it is one of the most widely used technology at the present time. Because it is able to efficiently use various types of operating systems in a physical computer. A virtual machine image that is a key component of virtualization is difficult to investigate. because the structure of virtual machine image is different from hard disk image. Therefore, we need researches about appropriate investigation procedure and method based on technical understanding of a virtual machine. In this research, we suggest a procedure of investigation on a virtual machine image and a method for a corrupted image of the VMware Workstation that has the largest number of users.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.20 no.3
• /
• pp.79-91
• /
• 2010

In digital forensics, the creation time, last modified time, and last accessed time of a file or folder are important factors that can indicate events that have affected a computer system. The form of the time information varies with the file system, depending on the user's actions such as copy, transfer, or network transport of files. Specific changes of the time information may be of considerable help in analyzing the user's actions in the computer system. This paper analyzes changes in the time information of files and folders for different operations of the NTFS and attempts to reconstruct the user's actions.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.16 no.9
• /
• pp.3068-3086
• /
• 2022

Digital Forensics is gaining popularity in adjudication of criminal cases as use of electronic gadgets in committing crime has risen. Traditional approach to collecting digital evidence falls short when the disk is encrypted. Encryption keys are often stored in RAM when computer is running. An approach to acquire forensic data from RAM when the computer is shut down is proposed. The approach requires that the investigator immediately cools the RAM and transplant it into a host computer provisioned with a tool developed based on cold boot concept to acquire the RAM image. Observation of data obtained from the acquired image compared to the data loaded into memory shows the RAM chips exhibit some level of remanence which allows their content to persist after shutdown which is contrary to accepted knowledge that RAM loses its content immediately there is power cut. Results from experimental setups conducted with three different RAM chips labeled System A, B and C showed at a reduced temperature of -25C, the content suffered decay of 2.125% in 240 seconds, 0.975% in 120 seconds and 1.225% in 300 seconds respectively. Whereas at operating temperature of 25℃, there was decay of 82.33% in 60 seconds, 80.31% in 60 seconds and 95.27% in 120 seconds respectively. The content of RAM suffered significant decay within two minutes without power supply at operating temperature while at a reduced temperature less than 5% decay was observed. The findings show data can be recovered for forensic evidence even if the culprit shuts down the computer.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2023.11a
• /
• pp.188-189
• /
• 2023

본 연구는 사용자가 USB에 내장된 스크립트를 실행하여 실시간으로 활성 및 비활성 데이터를 수집하는 라이브 포렌식 도구의 개발에 관한 것이다. 이 도구는 컴퓨터에 USB를 삽입하고 특정 스크립트를 실행하여 중요한 디지털 증거물을 추출하고 분석하는 기능을 제공한다. 도구는 Linux와 Windows 운영 체제용 32비트 및 64비트 버전으로 제작되었으며, 대량의 데이터 처리 시간과 저장 공간 문제를 해결하여 필요한 특정 데이터만 신속하게 추출할 수 있는 효율적인 방법을 제공한다. 이 도구는 활성 데이터와 비활성 데이터를 수집하며, 활성 데이터에는 레지스터, 네트워크 정보, 프로세스 정보, 사용자 정보 등이 포함되며, 비활성 데이터에는 메타데이터, 시스템 설정 정보, 로그 파일 등이 포함된다. 이 연구에서는 라이브 포렌식 도구의 사용 방법과 수집된 결과, 데이터 분석 방법, 그로 인한 보안 이점에 대해 다루고 있다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.29 no.1
• /
• pp.77-91
• /
• 2019

Recent Linux operating systems having been increasingly used, ranging from automotive consoles, CCTV, IoT devices, and mobile devices to various versions of the kernel. Because these devices can be used as strong evidence in criminal investigations, there is a risk of destroying evidence through file deletion. Ext filesystem forensics has been studied in depth because it can recovery deleted files without depending on the kind of device. However, studies have been carried out without consideration of characteristics of file system which may vary depending on the kernel. This problem can lead to serious situations, such as those that can impair investigative ability and cause doubt of evidence ability, when an actual investigation attempts to analyze a different version of the kernel. Because investigations can be performed on various distribution and kernel versions of Linux file systems at the actual investigation site, analysis of the metadata changes that occur when files are deleted by Linux distribution and kernel versions is required. Therefore, in this paper, we analyze the difference of metadata according to the Linux kernel as a solution to this and recovery deleted file. After that, the investigating agency needs to consider the metadata change caused by the difference of Linux kernel version when performing Ext filesystem forensics.