• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.33 no.1
• /
• pp.51-61
• /
• 2023

Messengers such as KakaoTalk, LINE, and Facebook Messenger are universal means of communication used by anyone. As the convenience functions provided to users and their usage time increase, so does the user behavior information remaining in the artifacts, which is being used as important evidence from the perspective of digital forensic investigation. However, for security reasons, most of the data is currently stored encrypted. In addition, cover-up behaviors such as intentional manipulation, concealment, and deletion are increasing, causing the problem of delaying digital forensic analysis time. In this paper, we conducted a study on the data decryption and artifacts analysis in a Windows environment for KakaoTalk, the messenger with the largest number of users in Korea. An efficient way of obtaining a decryption key and a method of identifying and decrypting messages attempted to be deleted are presented, and thumbnail artifacts are analyzed.

• Analytical Science and Technology
• /
• v.20 no.4
• /
• pp.339-346
• /
• 2007

To search the ninhydrin derivatives that have high chromogenic and fluorogenic properties, molecular holographic quantitative structure property relationship (HQSPR) models on the reactivity between glycine and ninhydrin analogues as latent fingerprint detector were derived and investigated quantitatively. The ${\varepsilon}LUMO$ (e.v.) energy of ninhydrin molecule was an important factor to reactivity of ninhydrin. And, it is suggested that the nucleophilic reaction by orbital-controlled reaction from the frontier molecular orbital (FMO) interaction between glycine and ninhydrin derivatives was more superior than that of electrophilic reaction by charged controlled reaction. The analytical results in atomic contribution maps also shows that the reactivity of ninhydrin was increased by meta-substituents as strong electron withdrawing groups on the benzo ring. Therefore, it is sugested by HQSPR and QSPR model that the 5,6-dinitroninhydrin molecule would increase the reactivity as much as three times as compared to none substituted ninhydrin molecule.

• The Korean Journal of Archival Studies
• /
• no.77
• /
• pp.109-150
• /
• 2023

Prior researchers interpreted the records of criminal cases involving the Progressive Party from a historical perspective. In marked contrast to existing trends, this study examines the Progressive Party case records through the lens of archival science. This study dissects the Progressive Party case records as a single and complete record group and at each stage of their life cycle from police investigation through criminal prosecution to trial. This approach enables a holistic analysis of archival characteristics of the records. This study begins with an appraisal of the nature and types of case records generated and maintained by the various agencies in light of the investigatory authorities delegated to each institution. This study then dissects the police, prosecution, and Counter Intelligence Corps records leading up to the indictment of Progressive Party members as well as the court records of the trial that followed. In particular, this study reveals the insufficiency and illegality of the evidence against the defendants in the Progressive Party case from an archival standpoint. Setting aside the admissibility or strength of the evidence under criminal law, the present study demonstrates that the records lack reliability, authenticity, and integrity-the fundamental attributes required for evidentiary efficacy of records from an archival standpoint.

• Proceedings of the Korean Institute of Navigation and Port Research Conference
• /
• 2022.06a
• /
• pp.214-217
• /
• 2022

In the maritime digital forensic part, it is very important and difficult process that analysis of data and information with vessel navigation system's binary log data for situation awareness of maritime accident. In recent years, analysis of vessel's navigation system's trajectory information is an essential element of maritime accident investigation. So, we made an experiment about corruption with various memory device in navigation system. The analysis of corruption test in seawater give us important information about the valid pulling time of sunken ship for acquirement useful trajectory information.

• Proceedings of the Korean Institute of Navigation and Port Research Conference
• /
• 2023.05a
• /
• pp.98-99
• /
• 2023

In the maritime digital forensic part, it is very important and difficult process that analysis of data and information with vessel navigation system's binary log data for situation awareness of maritime accident. In recent years, analysis of vessel's navigation system's trajectory information is an essential element of maritime accident investigation. So, we made an experiment about corruption with various memory device in navigation system. The analysis of corruption test in seawater give us important information about the valid pulling time of sunken ship for acquirement useful trajectory information.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.33 no.5
• /
• pp.753-760
• /
• 2023

KakaoTalk has the highest market share among domestic messengers. As such, KakaoTalk's conversation content is an important evidence in digital forensics, and the conversation is stored in the form of an encrypted database on a user's device. In addition, macOS has the characteristic that it is difficult to access because the disk encryption function is basically activated. The decryption method of the KakaoTalk database for Windows has been studied, but the decryption method has not been studied for KakaoTalk for macOS. In this paper, research the decryption method of the KakaoTalk database for macOS and a way to Brute-Force plan using the characteristics of KakaoTalk's UserID and compare it with KakaoTalk for Windows to examine the commonalities and differences. The results of this paper are expected to be used to analyze users' actions and events when investigating crimes using macOS.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.33 no.5
• /
• pp.737-751
• /
• 2023

The importance of digital forensics in the cloud environment is increasing as businesses and individuals move their data from On-premise to the cloud. Cloud data can be stored on various devices, including mobile devices and desktops, and encompasses a variety of user behavior artifacts, such as information generated from linked accounts and cloud services. However, there are limitations in securing and analyzing digital evidence due to environmental constraints of the cloud, such as distributed storage of data and lack of artifact linkage. One solution to address this is archiving services, and Google's Takeout is prime example. In this paper, user behavior data is analyzed for cloud forensics based on archiving data and necessary items are selected from an investigation perspective. Additionally, we propose the process of analyzing selectively collected data based on time information and utilizing web-based visualization to meaningfully assess artifact associations and multi-behaviors. Through this, we aim to demonstrate the value of utilizing archiving data in response to the increasing significance of evidence collection for cloud data.

• Proceedings of the Korean Society of Disaster Information Conference
• /
• 2023.11a
• /
• pp.295-296
• /
• 2023

2023년 우리나라에 발생한 재난은 남부지방의 가뭄, 태풍 카눈에 의한 폭우, 7월~9월 폭염 등의 자연재난과 4월 5일 분당 정자교 붕괴, 4월 29일 검단신도시 붕괴사고, 7월 13일 대구 염색산업단지 황산 누출 등의 사회재난이 발생하였다. 이전 2022년에는 022년 10월 29일, 서울 이태원역 부근에 대규모 인파가 한번에 몰리며 압사사고가 발생하여 159명이 목숨을 잃고 196명의 부상자가 발생하였다. 이처럼 다양한 형태로 발생하는 재난에 대하여 우리나라는 「헌법」과 「재난 및 안전관리 기본법」에서 재난으로부터 국민의 생명·신체 및 재산과 국가의 피해를 줄이기 위해 노력하여야 한다고 명시하고 있다. 재난은 다양한 특성을 지니고 있으며, 학자들의 일반적 견해는 누적성, 불확실성, 복잡성, 인지성 등의 특성을 들고 있다(재난관리론, 2020). 특히, 사회재난은 발생위치, 시점, 피해, 규모를 예측하기가 상대적으로 매우 어렵기에(장대원 외, 2019) 불확실성의 특성을 강하게 보여주고 있다. 이러한 사회재난의 특성은 자연재난과 비교하여 사람들에게 물리적·심리적 영향을 크게 미칠 뿐만 아니라 단기간에 회복하기 어려운 특성을 지닌다(신재헌 외, 2020). 이에 대하여 많은 국민들은 심각한 사회재난이 발생할 때마다 정부차원의 적극적 재난관리 및 통제능력 향상을 요구하고 있으나, 사회재난 특성 상 특정 기관 중심으로 대응하기에는 많은 어려움이 있다(신재헌 외, 2020). 우리나라 경찰은 2021년 7월부터 자치경찰제도를 실시하며 국민의 생명·신체 및 재산의 보호, 범죄예방, 수사 및 질서유지업무 이외에 국민들의 봉사·서비스 행정 요구의 증대로 인한 적극적·능동적 경찰활동으로 변화하게 되었다(조호대, 2014). 이에 따라 경찰은 경찰의 재난관리체계를 확립하고, 경찰의 재난관리에 관한 사항을 규정함을 목적으로 2012년 「경찰 재난관리규칙」을 제정하였다. 이에 본 연구에서는 경찰의 재난 발생 시 역할이 무엇이며, 특히 사회재난 시 경찰의 적극적 대응 방안은 무엇인가에 대하여 살펴보고자 한다.

• Journal of Internet Computing and Services
• /
• v.24 no.6
• /
• pp.99-105
• /
• 2023

In the 4th industrial revolution, the field of criminal justice is paying attention to Legaltech using artificial intelligence to provide efficient legal services. This paper attempted to create a crime prediction model that can apply Recurrent Neural Network(RNN) to increase the potential for using legal technology in the domestic criminal justice field. To this end, the crime process was divided into pre, during, and post stages based on the criminal facts described in the judgment, utilizing crime script analysis techniques. In addition, at each time point, the method and evidence of crime were classified into objects, actions, and environments based on the sentence composition elements and the 8 principles of investigation. The case summary analysis framework derived from this study can contribute to establishing situational crime prevention strategies because it is easy to identify typical patterns of specific crime methods. Furthermore, the results of this study can be used as a useful reference for research on generating crime situation prediction data based on RNN models in future follow-up studies.

• Journal of the Society of Disaster Information
• /
• v.19 no.4
• /
• pp.908-915
• /
• 2023

Purpose: The purpose of this study is to examine the types of fraudulent crimes among various crimes taking place during NFT transactions, and to approach institutional problems caused by crime types analysis and crackdown methods and legal limitations. Method: IIn order to classify the types of fraudulent crimes that appear in NFT transactions, the crime types were analyzed through the results of previous studies and cases of current incidents. Result: Most of the crimes that are taking place through NFTs are various types of fraudulent crimes such as rug pools, thefts, personal information theft fraud, and pig murder. Therefore, these types were classified and various damage cases were also analyzed. It is a matter of copyright. Conclusion: Currently, the financial problems caused by the occurrence of fraudulent crimes in NFTs worldwide are the most worrisome, and the scale will be even greater as the market grows in the future. Therefore, in Korea, various institutional supplements and policies should be prepared through analysis of crime types that can affect crime prevention and investigation and arrest activities.