Browse > Article
http://dx.doi.org/10.13089/JKIISC.2017.27.3.489

Improved Data Concealing and Detecting Methods for OOXML Document  

Hong, Kiwon (Dept. of Financial Information Security, Kookmin University)
Cho, Jaehyung (Dept. of Financial Information Security, Kookmin University)
Kim, Soram (Dept. of Financial Information Security, Kookmin University)
Kim, Jongsung (Dept. of Financial Information Security, Kookmin University)
Publication Information
Journal of the Korea Institute of Information Security & Cryptology / v.27, no.3, 2017 , pp. 489-499 More about this Journal
Abstract
MS office is a office software which is widely used in the world. The OOXML format has been applied to the document structure from MS office 2007 to the newest version. In this regard, the method of data concealing, which is a representative anti-forensic act has been researched and developed, so the method of detecting concealed data is very important to the digital forensic investigation. In this paper, we present an improved data concealing method bypassing the previewers detecting methods for OOXML formatted MS office documents. In addition, we show concealment of the internal data like sheets and slides for MS office 2013 Excel and PowerPoint, and suggest an improved detecting algorithm against this data concealing.
Keywords
Digital forensics; OOXML; MS office; Data concealing; Detection of concealed data;
Citations & Related Records
연도 인용수 순위
  • Reference
1 Zhangjie Fu, Xingming Sun, Yuling Liu, Bo Li, "Forensic Investigation of OOXML format documents", Digital Investigation, vol. 8, pp. 48-55, Apr. 2011   DOI
2 Wujin Jang, Yujung Han, "Company Report - Hangul and Computer (030520)", KB security, Jul. 2016
3 ECMA-376-1 :2016, Edition Office Open XML File Formats - Fundamentals and Markup Language Reference, ECMA International Publication, Oct. 2015
4 ECMA-376, 4th Edition Office Open XML File Formats - Open Packaging Conventional, ECMA International Publication, Dec. 2012
5 Bora Park, Jungheum Park, Sangjin Lee, "Data concealment and detection in Microsoft Office 2007 files", Digital Investigation, vol. 5, pp. 104-114, Dec. 2008