• KIPS Transactions on Computer and Communication Systems
• /
• v.6 no.2
• /
• pp.95-104
• /
• 2017

As the technology in smart device is growing and Social Network Services(SNS) are becoming more common, the data which is difficult to be processed by existing RDBMS are increasing. As a result of this, NoSQL databases are getting popular as an alternative for processing massive and unstructured data generated in real time. The demand for the technique of digital investigation of NoSQL databases is increasing as the businesses introducing NoSQL database in their system are increasing, although the technique of digital investigation of databases has been researched centered on RDMBS. New techniques of digital forensic investigation are needed as NoSQL Database has no schema to normalize and the storage method differs depending on the type of database and operation environment. Research on document-based database of NoSQL has been done but it is not applicable as itself to other types of NoSQL Database. Therefore, the way of operation and data model, grasp of operation environment, collection and analysis of artifacts and recovery technique of deleted data in HBase which is a NoSQL column-based database are presented in this paper. Also the proposed technique of digital forensic investigation to HBase is verified by an experimental scenario.

• Review of KIISC
• /
• v.18 no.1
• /
• pp.62-69
• /
• 2008

디지털 기기의 기능이 발달하고, 디지털 기기의 보급이 활발해 지면서 PDA, 디지털 카메라, 휴대폰 등의 디지털 장비들이 생활필수품이 되었다. 특히 휴대폰은 국내의 약 86%에 달하는 사람들이 사용하고 있는 디지털 장비로 전화통화 뿐만 아니라 문자메시지, 사진기능, 동영상 기능 등과 같은 많은 기능을 제공한다. 이러한 휴대폰은 여러 기능을 제공함에 따라 사용자와 관련된 많은 정보를 담고 있어 사건 발생 시 분석되어야 할 중요한 물품 중에 하나가 되었다. 그러나 국내 휴대폰의 경우 제조사나 모델의 종류에 따라 휴대폰 메모리 사용방식이 달라 휴대폰 분석에 많은 어려움이 있다. 이에 본 논문에서는 휴대폰 포렌식 절차와 기술, 그리고 현재 국내에서 사용되고 있는 도구들에 대해 간략히 설명하고 이와 함께 국내휴대폰 포렌식 분야에서의 문제점이 무엇인지 알아보고 대안을 제시하고자 한다.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2011.11a
• /
• pp.866-867
• /
• 2011

정보화 시대가 빠르게 진행됨에 따라, 우리는 디지털 기기들을 항상 휴대하고 생활한다. 하지만 디지털 장치의 보급은 사이버 범죄의 수단으로 악용되고 있다. 이런 문제를 해결하기 위해 디지털 포렌식에 대한 다양한 연구가 활발히 진행 중이다. 본 논문에서는 디지털 포렌식 기술 연구 동향에 대해 살펴본 후 최근 문제점 및 이유 사항에 대해 논의 한다.

• Review of KIISC
• /
• v.18 no.1
• /
• pp.29-40
• /
• 2008

기업의 회계 투명성을 제고하기 위해 각 국에서는 회계 제도를 개혁하고 있으며, 이로 인하여 기업의 회계 정보 신뢰도 검증이 중요 사안이 되었다. 기업 회계 정보의 검증을 위한 방안으로 회계 감사와 디지털 포렌식이 결합한 포렌식 어카운팅 기법을 적용할 수 있으며, 이를 위해서는 포렌식 어카운팅에 대한 정의와 함께 기술 동향을 살펴볼 필요가 있다. 따라서 본 고에서는 포렌식 어카운팅의 정의와 필요성을 제시하며, 해외에서 활용되고 있는 도구들의 소개와 함께 회계 정보를 분석할 수 있는 대표적인 기법들을 간략히 설명한다. 이와 함께 해외 포렌식 어카운팅 시장의 현황을 살펴봄으로써 향후 발전 가능성을 전망한다.

• The KIPS Transactions:PartC
• /
• v.17C no.4
• /
• pp.335-346
• /
• 2010

Mac OS X is the Computer Operating System that develop in Apple Inc. Mac OS X is the successor to Mac OS 9 Version which had been Apple's primary operating system since 1984. Recently, Mac OS X 10.6 (Snow Leopard) has been manufactured and is distributed to user. Apple's Mac OS X Operating System is occupying about 10% in the world Operating System market share. But, Forensic tools that is utilized on digital forensic investigation can not forensic analysis about Mac OS X properly. To do forensic investigation about Mac OS X, information connected with user's action and trace can become important digital evidence in Operating System. This paper presents way about user trace data acquisition methodology in Mac OS X.

• KIPS Transactions on Computer and Communication Systems
• /
• v.5 no.7
• /
• pp.173-180
• /
• 2016

Since smartphones possess a variety of user information, we can derive useful data related to the case from app data analysis in the digital forensic perspective. However, it requires an appropriate forensic measure as smartphone has the property of high mobility and high possibility of data loss, forgery, and modulation. Especially the forged/modulated time-stamp impairs the credibility of digital proof and results in the perplexity during the timeline analysis. This paper provides traces of usage which could investigate whether the time-stamp has been forged/modulated or not within the range of iOS based devices.

• Journal of Digital Forensics
• /
• v.12 no.3
• /
• pp.39-54
• /
• 2018

Recently, discussions for the eradication of illegal shooting have been carried out in a socially-oriented way. The government has established comprehensive measures to eradicate cyber sexual violence crimes such as illegal shooting. Although the social interest in illegal shooting has increased, the illegal film shooting case is evolving more and more due to the development of information and communication technology. Applications that can hide confused videos are constantly circulating around the market and community sites. As a result, field investigators and professional analysts are experiencing difficulties in collecting and analyzing evidence. In this paper, we propose an evidence collection and analysis framework for illegal shooting cases in order to give practical help to illegal shooting investigation. We also proposed a system that can detect hidden applications, which is one of the main obstacles in evidence collection and analysis. We developed a detection tool to evaluate the effectiveness of the proposed system and confirmed the feasibility and scalability of the system through experiments using commercially available concealed apps.

• Journal of Advanced Navigation Technology
• /
• v.17 no.3
• /
• pp.325-331
• /
• 2013

Social network services(SNS) has been used as a means of communication for user or express themselves user. Therefore, SNS has a variety of information. This information is useful to help the investigation can be used as evidence. In this paper, A study of mobile digital forensic procedure for crime investigation in social network service. Analysis of database file taken from the smartphone at social network service application for mobile digital forensic procedure. Therefore, we propose a procedure for the efficient investigation of social network service mobile digital forensic.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.20 no.6
• /
• pp.43-51
• /
• 2010

It is meaningful to investigate data in unallocated space because we can investigate the deleted data. Consecutively complete file recovery using the File Carving is possible in unallocated area, but noncontiguous or incomplete data recovery is impossible. Typically, the analysis of the data fragments are needed because they should contain large amounts of information. Microsoft Word, Excel, PowerPoint and PDF document file's text are stored using compression or specific document format. If the part of aforementioned document file was stored in unallocated data fragment, text extraction is possible using specific document format. In this paper, we suggest the method of extracting a particular document file text in unallocated data fragment.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.24 no.5
• /
• pp.851-860
• /
• 2014

With an increasing demand of powerful electronic goods, smart TV containing network module with digital TV gets more popular. These change are meaningful from a digital forensics perspective because smart TV store more user's data than digital TV. In this paper, we suggest smart TV forensics as a branch of digital forensics. With smart TV forensics, investigator can trace more wide age group's activities than existing digital forensics analysis.