• Bulletin of the Korean Chemical Society
• /
• v.33 no.4
• /
• pp.1357-1359
• /
• 2012

• Journal of Korea Society of Industrial Information Systems
• /
• v.17 no.7
• /
• pp.95-100
• /
• 2012

Currently, crimes are becoming increasingly dense, the technique is also very tricky. Pickpocket, the theft of crime, is occurred at the most crowded or congested places. However, nowadays occurs more commonly at the rare and secluded place in the human. In this paper, we investigate the techniques and types of pickpockets. And realistically to submit classified video, to standing, sitting, and lying to the classification. Target for pickpockets, we classify it to submit a video forensic evidence. This paper will be needed in order to prevent and cope with pickpockets crimes.

• Journal of Korea Society of Digital Industry and Information Management
• /
• v.15 no.4
• /
• pp.111-116
• /
• 2019

The digital forensic analysis ensures the integrity of confiscated data by calculating hash values for seizure and search of digital evidence and receiving confirmation and signature from participants. However, evidence that is irrelevant to the alleged offense needs to be deleted even after seizure from the point of view of privacy. But the hash value is altered by deleting the irrelevant data from the image file, one will not be able to prove that the file is in the initial state when it was seized. Therefore, in this paper, a study was conducted to support the integrity of the digital evidence, even if some of the seized digital evidence was deleted or damaged during the seizure search. The hash value of each data is calculated and hash value of the combination of hash values are also calculated. Even if the unrelated evidence is deleted from the seized evidence regardless of file system such as FAT or NTFS, the suggested method presented a way to provide the integrity that proves there is no change in the evidence file.

• KIPS Transactions on Computer and Communication Systems
• /
• v.5 no.12
• /
• pp.491-498
• /
• 2016

Recently leakages of confidential information and internal date have been steadily increasing by using booting technique on portable OS such as Windows PE stored in portable storage devices (USB or CD/DVD etc). This method allows to bypass security software such as USB security or media control solution installed in the target PC, to extract data or insert malicious code by mounting the PC's storage devices after booting up the portable OS. Also this booting method doesn't record a log file such as traces of removable storage devices. Thus it is difficult to identify whether the data are leaked and use trace-back technique. In this paper is to propose method to help facilitate the process of digital forensic investigation or audit of a company by collecting and analyzing BIOS firmware images that record data relating to BIOS settings in flash memory and finding traces of portable storage devices that can be regarded as abnormal events.

• The Journal of Korean Institute of Information Technology
• /
• v.17 no.8
• /
• pp.1-9
• /
• 2019

With the development of imaging information communication technology in modern society, imaging acquisition and mass production technology have developed rapidly. However, crime rates using these technology are increased and forensic studies are conducted to prevent it. Identification techniques for image acquisition devices are studied a lot, but the field is limited to images. In this paper, camera model identification technique for video, not image is proposed. We analyzed video frames using the trained model with images. Through training and analysis by considering the frame characteristics of video, we showed the superiority of the model using the P frame. Then, we presented a video camera model identification system by applying a majority-based decision algorithm. In the experiment using 5 video camera models, we obtained maximum 96.18% accuracy for each frame identification and the proposed video camera model identification system achieved 100% identification rate for each camera model.

• Proceedings of the KIEE Conference
• /
• 2007.10a
• /
• pp.243-244
• /
• 2007

웹 서버에서 로그파일은 웹 서버에 대한 접속정보를 저장한다. 이 정보를 분석하면 웹 서비스를 하는데 있어서 서비스의 질을 높이는데 좋은 참고자료가 될 뿐 아니라 웹 서버에 이상이 생겼을 경우 발생한 오류를 조기에 발견하는 데에도 사용되는 중요한 자료이다. 현재 이러한 로그파일은 텍스트 파일로 저장이 되어있으며 오랜 시간이 지나 그 웹 페이지가 삭제되었을 경우 로그파일에 기록된 그 시각의 웹 페이지를 찾아보기가 어렵다. 본 연구에서는 로그파일에 기록된 그 시각의 웹 페이지의 이미지를 저장하는 방법으로 이러한 단점을 보안하고 오랜 시간이 지난 후에도 그 웹 페이지를 볼 수 있는 방법을 제안한다. 이 아이디어가 구현되어 실현되면 또한 Digital Forensic으로써 범죄 수사에도 많은 도움이 될 뿐만 아니라 휴대전화로 풀 인터넷 브라우징이 가능한 풀브라우저에도 적용될 수 있다.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2007.11a
• /
• pp.298-299
• /
• 2007

웹 서버에서 로그파일은 웹 서버에 대한 접속정보를 저장한다. 이 정보를 분석하면 웹 서비스를 하는데 있어서 서비스의 질을 높이는데 좋은 참고자료가 될 뿐 아니라 웹 서버에 이상이 생겼을 경우 발생한 오류를 조기에 발견하는 데에도 사용되는 중요한 자료이다. 현재 이러한 로그파일은 텍스트 파일로 저장이 되어있으며 오랜 시간이 지나 그 웹 페이지가 삭제되었을 경우 로그파일에 기록된 그 시각의 웹 페이지를 찾아보기가 어렵다. 본 연구에서는 로그파일에 기록된 그 시각의 웹 페이지의 이미지를 저장하는 방법으로 이러한 단점을 보안하고 오랜 시간이 지난 후에도 그 웹 페이지를 볼 수 있는 방법을 제안한다. 이 아이디어가 구현되어 실현되면 또한 Digital Forensic 으로써 범죄 수사에도 많은 도움이 될뿐만 아니라 휴대전화로 풀 인터넷 브라우징이 가능한 풀브라우저에도 적용될 수 있다.

• Journal of Oral Medicine and Pain
• /
• v.21 no.1
• /
• pp.37-54
• /
• 1996

In this thesis, a new superimposition scheme using a computer vision system was proposed with 7 pairs of skull and ante-mortem photographs, which were already identified through other tests and DNA fingerprints at the Korea National Institute of Scientific Investigation. At this computer vision system, an unidentified skull was caught by video-camcoder with the MPEG and a ante-mortem photograph was scanned by scanner. These two images were processed and superimposed using pixel processing. Recognition of the individual identification by anatomical references was performed on the two superimposed images. These results were as followings. 1. For the enhancement of skull and ante-mortem photographs, various image processing schemes, such as SMOOTH, SHARPEN, EMBOSS, MOSAIC, ENGRAVE, INVERT, NEON and COLOR TO MONO, were applied using 3*5 window processing. As an image processing result of these methods, the optimal techniques were NEON, INVERT and ENGRAVE for the edge detection of skull and ante-mortem photograph. 2. Using various superimposition image processing techniques (SRCOR, SRCAND, SRCINVERT, SRCERASE, DSTINVERT, MERGEPAINT) were compared for the enhancement of image recognition. 3. By means of the video camera, the skull image was inputed directly to a computer system : superimposing it on the ante-mortem photograph made the identification more precise and time-saving. As mentioned above, this image processing techniques for the superimposition of skull and ante-mortem photographs simply used the previous approach, In other wrods, taking skull photographs and developing it to the same size as the ante-mortem photographs. This system using various image processing techniques on computer screen, a more precise and time-saving superimposition technique could be able to be applied in the area of individual identification in forensic practice.

• Journal of the Institute of Electronics and Information Engineers
• /
• v.53 no.2
• /
• pp.47-52
• /
• 2016

The used digital images in the smart device and small displayer has been a downscaled image. In this paper, the detection of the downscaling image forgery is proposed using the feature vector according to the pixel value's gradients. In the proposed algorithm, AR (Autoregressive) coefficients are computed from pixel value's gradients of the image. These coefficients as the feature vectors are used in the learning of a SVM (Support Vector Machine) classification for the downscaling image forgery detector. On the performance of the proposed algorithm, it is excellent at the downscaling 90% image forgery compare to MFR (Median Filter Residual) scheme that had the same 10-Dim. feature vectors and 686-Dim. SPAM (Subtractive Pixel Adjacency Matrix) scheme. In averaging filtering ($3{\times}3$) and median filtering ($3{\times}3$) images, it has a higher detection ratio. Especially, the measured performances of all items in averaging and median filtering ($3{\times}3$), AUC (Area Under Curve) by the sensitivity and 1-specificity is approached to 1. Thus, it is confirmed that the grade evaluation of the proposed algorithm is 'Excellent (A)'.

• KIPS Transactions on Software and Data Engineering
• /
• v.10 no.10
• /
• pp.421-428
• /
• 2021

The High Efficiency Image File Format (HEIF) is an MPEG-developed image format that utilizes the video codec H.265 to store still screens in a single image format. The iPhone has been using HEIF since 2017, and Android devices such as the Galaxy S10 have also supported the format since 2019. The format can provide images with good compression rates, but it has a complex internal structure and lacks significant compatibility between devices and software, making it not popular to replace commonly used JPEG (or JPG) files. However, despite the fact that many devices are already using HEIF, digital forensics research regarding it is lacking. This means that we can be exposed to the risk of missing potential evidence due to insufficient understanding of the information contained inside the file during digital forensics investigations. Therefore, in this paper, we analyze the HEIF formatted photo file taken on the iPhone and the motion photo file taken on the Galaxy to find out the information and features contained inside the file. We also investigate whether or not the software we tested support HEIF and present the requirement of forensic tools to analyze HEIF.