• The Journal of Society for e-Business Studies
• /
• v.22 no.1
• /
• pp.107-122
• /
• 2017

Nowadays, digital forensic experts are not only computer experts who restore and find deleted files, but also general experts who posses various capabilities including knowledge about processes/laws, communication skills, and ethics. However, there have been few studies about qualifications or competencies required for digital forensic experts comparing with their importance. Therefore, in this study, AHP questionnaires were distributed to digital forensic experts and analyzed to derive priorities of competencies; the first-tier questions which consisted of knowledge, technology, and attitude, and the second-tier ones which have 20 items. Research findings showed that the most important competency was knowledge, followed by technology and attitude but no significant difference was found. Among 20 items of the second-tier competencies, the most important competency was "digital forensics equipment/tool program utilization skill" and it was followed by "data extraction and imaging skill from storage devices." Attitude such as "judgment," "morality," "communication skill," "concentration" were subsequently followed. The least critical one was "substantial law related to actual cases." Previous studies on training/education for digital forensics experts focused on law, IT knowledge, and usage of analytic tools while attitude-related competencies have not given proper attention. We hope this study can provide helpful implications to design curriculum and qualifying exam to foster digital forensic experts.

• The Journal of Korean Association of Computer Education
• /
• v.17 no.3
• /
• pp.75-84
• /
• 2014

It is a current situation that a large number of physical and financial damages are increasing due to the growth of intellectual cyber crime and unexpected Internet incidents year by year. In the large scale security incidents, digital forensics techniques for computer crime investigations are essential to secure a place in the field. However, qualified digital forensics investigators who complete with digital security technology are practically insufficient in domestic. In this paper, as one of developing human resources plans regarding to scientific investigation of Internet security incidents, an undergraduate curriculum per stage in digital forensics was proposed. For the effective curriculum per stage, the interviews, group discussion on focused group of existing digital forensics investigators and related research were performed to select curriculum, and then the level of difficulty and practical suitability on each subject designed were analyzed through survey and interview to current investigators and security professionals. After collating the survey, the digital forensic curriculum per level was designed to highly adaptable workforce for the future for working and positive suggestions and proposals are addressed.

• Convergence Security Journal
• /
• v.5 no.1
• /
• pp.11-18
• /
• 2005

With the develoment of IT(Information Technologies) in Internet, Digital crime are increasing explosive every year. Recently, digital crime is taken advantage of technical and expert skill. It is necessary to investigate a digital crime that Digital forensic process standardization, Specialist training & education, R&D, Government support. So in this paper we proposed device of the grow of digital forensic that make analysis of the present state domestic digital forensic technique.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.18 no.4
• /
• pp.779-789
• /
• 2014

A number of universities around the world provide various undergraduate and graduate programs for digital forensic. In this paper, we propose a cross-layer program suitable for senior students in the IT and law departments to learn multi-disciplinary convergence subjects. We have first analyzed the key ingredients of digital forensic and then the current programs in several universities. After describing the qualifications anticipated for digital forensic specialists, we have critically analyzed the courses currently offered in the IT and law departments. Based on the analysis and discussions, we have proposed an IT+law program and two flexible operation schemes of the program for securing the desired level of convergence education.

• Convergence Security Journal
• /
• v.12 no.5
• /
• pp.79-85
• /
• 2012

This research is to improve the education courses for nurturing digital forensic exports. To do so, the education courses for nurturing digital forensic exports were proposed and surveys targeting forensic professionals are conducted. Using AHP method, the most rational and important education courses among aspects (forensic introduction, system forensic, theories and analyses by categories, tool using, and research work) were drawn from results from the above. From this research, it is to improve the education courses for nurturing digital forensic experts applying rational courses with high status.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.33 no.4
• /
• pp.647-659
• /
• 2023

As digital evidence becomes more important in criminal investigations, disputes are increasing in court. As media diversifies and the scope of analysis expands, the level of expertise in digital forensics is also increasing. However, no competency model has been developed to define the capabilities of digital evidence examiners or to judge their expertise. There have been some studies that have derived the capabilities necessary for digital evidence examiner, but they are still insufficient. Therefore, in this study, 25 competency evaluation factors in a total of 9 competency groups were defined using methodologies such as expert FGI and Delphi survey. Specifically, it was defined as Digital Forensics Theory, Digital Evidence Collection&Management, Disk Forensics, Mobile Forensics, Video Forensics, infringement forensics, DB Forensics, Embedded(IoT) Forensics, and Cloud Forensics. The digital evidence examiner competency model is expected to be used in various fields such as recruitment, education and training, and performance evaluation in the future.

• Information Systems Review
• /
• v.19 no.2
• /
• pp.185-209
• /
• 2017

In modern society, crime records have been digitized. Digital information is difficult to distinguish from original information, but the former is easy to modulate. This situation explains the increasing importance of digital forensics. However, digital forensic has several inefficiencies because of the rapid development of technology, unclear jurisdiction, and tool errors. This study surveyed digital forensic specialists and derived the priority of domestic digital forensic issues by redefining 17 issues in digital forensics from Brungs-Jamieson study in Australia. The present study was divided into four groups, namely, police, government and public corporations, private companies, and legal groups. The study could compare and analyze comparative analysis of existing studies in Australia and the US. This study can also examine differences in the results of each group in Korea. Thus, the key issues in Korea were derived as "Requirements to 'Fire Up' Original." The differences of the three groups in terms of legal issues were then identified. This finding enables us to understand differences in priorities and importance between groups and countries.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2017.11a
• /
• pp.310-313
• /
• 2017

범죄수사 과정에서 많은 양의 데이터를 시간 내에 분석하는 것은 성공적인 포렌식의 필수 요소이다. 컴퓨터와 사람 모두에게 있어, 시간과 자원의 제한은 수사 결과에 부정적인 영향을 가져온다. 그러므로 현재 사용되고 있는 다양한 포렌식 도구에는 시간과 자원의 효율적인 사용이 필요하다. 사례기반추론 및 멀티에이전트 시스템과 같은 인공지능 기반의 도구를 통해 디지털 포렌식 수사를 효과적으로 도울 수 있다. 본 논문에서는 인공지능을 활용한 지능형 포렌식 도구 및 프레임워크를 분석하고, 오늘날의 프레임워크의 한계점과 미래에 관해 논의한다. 인공지능 기반 시스템의 목적은 수사에서의 증거를 포함한 데이터를 분석하고 연관성을 밝힘으로서 포렌식 전문가에게 중요한 단서를 제공하고 직접 분석해야하는 데이터의 양을 줄이는 것에 있다. 이러한 인공지능의 활용은 많은 양의 데이터를 수사할 때 사람이 간과할 수 있는 증거들을 연결시켜주는 데에 큰 도움이 된다.

• Convergence Security Journal
• /
• v.22 no.5
• /
• pp.21-35
• /
• 2022

The use of digital information according to the development of information and communication technology and the 4th industrial revolution is continuously increasing and diversifying, and in proportion to this, crimes using digital information are also increasing. However, there are few cases of establishing an environment for processing and analysis of digital evidence in Korea. The budget allocated for each organization is different and the digital forensics laboratory built without solving the chronic problem of securing space has a problem in that there is no standard that can be referenced from the initial configuration stage. Based on this awareness of the problem, this thesis conducted an exploratory study focusing on tools and equipment necessary for building a digital forensics laboratory. As a research method, focus group interviews were conducted with 15 experts with extensive practical experience in the digital forensic laboratory or digital forensics field and experts' opinions were collected on the following 9 areas: network configuration, analyst computer, personal tools·equipment, imaging devices, dedicated software, open source software, common tools/equipment, accessories, and other considerations. As a result, a list of tools and equipment for digital forensic laboratories was derived.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.13 no.8
• /
• pp.1687-1692
• /
• 2009

Cyber forensics is used the process and technology of digital forensics as a criminal investigation in cyber space. Cyber crime is classified into cyber terror and general cyber crime, and those two classes are connected with each other. The investigation of cyber terror requires high technology, system environment and experts, and general cyber crime is connected with general crime by evidence from digital data in cyber space. Accordingly, it is difficult to determine relational crime types, collect evidence and the legal admissibility of evidence. Therefore, we considered the classifications of cyber crime, the collection of evidence in cyber space and the application of laws to cyber crime. In order to efficiently investigate cyber crime, it is necessary to integrate those concepts for each cyber crime-case. In this paper, we constructed a cyber forensics domain ontology for cyber criminal investigation using the concepts, relations and properties, according to categories of cyber crime, laws, evidence, and information of criminals and crime-cases. This ontology can be used in the process of investigating of cyber crime-cases, and for data mining of cyber crime; classification, clustering, association and detection of crime types, crime cases, evidences and criminals.