Browse > Article
http://dx.doi.org/10.3745/KIPSTC.2010.17C.5.391

A Framework for Data Recovery and Analysis from Digital Forensics Point of View  

Kim, Jin-Kook (고려대학교 정보경영공학전문대학원)
Park, Jung-Heum (고려대학교 정보경영공학전문대학원)
Lee, Sang-Jin (고려대학교 정보경영공학전문대학원)
Publication Information
The KIPS Transactions:PartC / v.17C, no.5, 2010 , pp. 391-398 More about this Journal
Abstract
Most of digital forensics tools focus on file analysis of allocated area on storage. So, there is a lack of recovery methods for deleted files by suspects or previously used files. To efficiently analyze deleted files, digital forensic tools depend on data recovery tools. These process not appropriate for quick and efficient responses the incident or integrity preservation. This paper suggests the framework for data recovery and analysis tools from digital forensics point of view and presents implementation results.
Keywords
Digital Forensics; Framework; Data Recovery; Data Carving;
Citations & Related Records
연도 인용수 순위
  • Reference
1 TopTenREVIEWS, http://data-recovery-software-review.toptenreviews.com/
2 김진국 외 4명, “파일카빙 기법에 관한 연구”, 디지털 포렌식연구 2호, 2008년 6월.
3 Joachim Metz, Bas Kloet and Robert-Jan Mora, “Analysis of 2007 DFRWS Forensic Carving Chllenge - The 07 smart carving approach,” Digital Forensic Research Workshop (DFRWS), July, 2007.
4 Peter Gutmann, “Secure Deletion of Data from Magnetic and Solid-State Memory,” Sixth USENIX Security Symposium, July, 1996.
5 Microsoft support site, http://support.microsoft.com/kb/140365.
6 Simson L. Garfinkel, “Carving contiguous and fragmented files with fast object validation,” Volume 4, Supplement 1, September 2007.   DOI
7 김진국 외 2명, “Flase-Positive를 줄이기 위한 향상된 파일 카빙 기법 연구”, 안티 포렌식 대응기술 워크샵, 2008년 8월.
8 김진국 외 4명, “파일카빙에서의 파일이름 결정 방법”, 한국정보보호학회 동계학술대회, 2008년 12월.
9 Brian Carrier, “File System Forensic Analysis,” Addison Wesley Professional, P139-140, 2005.
10 Steve Bunting, “The Official EnCase Certified Examiner STUDY GUIDE Second Edition,” Sybex, 2007.
11 National Software Reference Library, http://www.nsrl.nist.gov/
12 IDA Pro, http://www.hex-rays.com/idapro/
13 OllyDbg, http://www.ollydbg.de/
14 Nicole Lang Beebe, Jan Guynes Clark, “A hierarchical, objectives-based framework for the digital investigations process,” Digital Investigation, Vol.2, June, 2005.   DOI
15 Brian D. Carrier, Eugene H. Spafford, “An Event-Based Forensic Investigation Framework,” Digital Forensic Research Workshop (DFRWS), Aug., 2004.
16 Ricci S.C. leong, “FORZA - Digital forensics investigation framework that incorporate legal issues,” Digital Investigation, Vol.3, September, 2006.   DOI
17 M.I. Cohen, “PyFlag - An advanced network forensic framework,” Digital Investigation, Vol.5, September, 2008.   DOI
18 Dr. Ren Wei, “A Framework of Distributed Agent-based Network Forensics System,” Digital Forensic Research Workshop (DFRWS), Aug., 2004.
19 Nick L. Petroni, Jr., AAron Walters, Timothy Fraser and William A.Arbaugh, “FATKit : A framework for the extraction and analysis of digital forensic data from volatile system memory,” Digital Investigation, Vol.3, December, 2006.   DOI
20 Mark Reith, Clint Carr and Gregg Gunsch, “An Examination of Digital Forensic Models,” International Jounal of Digital Evidence, Vol.1, Issue 3, Fall 2002,
21 Jeroen van den Bos and Ronald van der Knijff, “TULP2G-An Open Source Forensic Software Framework for Acquiring and Decoding Data Stored in Electronic Devices,” International Journal of Digital Evidence, Vol.4, Issue 2, Fall 2005.
22 EnCase Forensic, http://www.guidancesoftware.com/computer-forensics-ediscovery-software-digital-evidence.htm
23 FTK(Forensic Toolkit), http://www.accessdata.com/forensictoolkit.html
24 FINALForensics, http://www.finaldata.co.kr/Forum/?s=FRM.FF2