Browse > Article
http://dx.doi.org/10.3745/KTCCS.2017.6.7.307

A Study on Image Acquisition and Usage Trace Analysis of Stick-PC  

Lee, Han Hyoung (고려대학교 정보보호대학원 정보보호학과)
Bang, Seung Gyu (고려대학교 정보보호대학원 정보보호학과)
Baek, Hyun Woo (고려대학교 정보보호대학원 정보보호학과)
Jeong, Doo Won (고려대학교 정보보호대학원 정보보호학과)
Lee, Sang Jin (고려대학교 정보보호대학원)
Publication Information
KIPS Transactions on Computer and Communication Systems / v.6, no.7, 2017 , pp. 307-314 More about this Journal
Abstract
Stick-PC is small and portable, So it can be used like a desktop if you connect it to a display device such as a monitor or TV anytime and anywhere. Accordingly, Stick-PC can related to various crimes, and various evidence may remain. Stick-PC uses the same Windows version of the operating system as the regular Desktop, the artifacts to be analyzed are the same. However, unlike the Desktop, it can be used as a meaningful information for forensic investigation if it is possible to identify the actual user and trace the usage by finding the traces of peripheral devices before analyzing the system due to the mobility. In this paper, We presents a method of collecting images using Bootable OS, which is one of the image collection methods of Stick-PC. In addition, we show how to analyze the trace of peripheral connection and network connection trace such as Display, Bluetooth through the registry and event log, and suggest the application method from the forensic point of view through experimental scenario.
Keywords
Peripheral Device; Digital Forensic; Stick-PC; Connection Trace; Image Acquisition;
Citations & Related Records
Times Cited By KSCI : 1  (Citation Analysis)
연도 인용수 순위
1 Intel [internet], http://www.intel.co.kr/content/www/kr/ko/compute-stick/intel-compute-stick.html.
2 Yonghak Shin, Junyoung Cheon and Jongsung Kim, "Study on Recovery Techniques for the Deleted or Damaged Event Log (EVTX) Files," Journal of the Korea Institute of Information Security & Cryptology, Vol.26, No.2, pp.387-396, 2016.   DOI
3 Sang Jin Oh and Kyu Ho kim, "A Study on The Procedure Analysis Vulnerability for Security Incidents using The Registry Parsing," Conference Workshop of The Institute of Electronics Engineers of Korea, pp.287-290, 2016.
4 Harlan Carvey, "The Windows Registry as a forensic resource," Digital Investigation, Vol.2, Issue 3, pp.201-205, 2005.   DOI
5 Forensic Toolkit (FTK) [internet], http://accessdata.com/solutions/digital-forensics/forensic-toolkit-ftk.
6 EnCase Forensic [internet], https://www.guidancesoftware.com/encase-forensic?cmpid=nav_r.
7 Ubuntu(Linux OS) [internet], https://www.ubuntu.com/download.
8 kali-km_Security Study [Internet], kali-km.tistory.com/entry/Windows-Event-Log-2---주요-이벤트-로그.