• Journal of Korea Multimedia Society
• /
• v.15 no.11
• /
• pp.1292-1304
• /
• 2012

Recently, digital images are extremely forged by editors or advertisers. Also, amateurs can modify images throughout easy editing programs. In this study, we propose identification and analytical methods for the modified images to figure out those problems. In modified image analysis, we classify two parts; a filtering change and a geometric change. Those changes have an algorithm based on interpolation so that we propose the algorithm which is able to analyze a trace on a modified area. With this algorithm, we implement a detection map of interpolation using minimum filter, laplacian algorithm, and maximum filter. We apply the proposed algorithm to modified image and are able to analyze its modified trace using the detection map.

• KIPS Transactions on Computer and Communication Systems
• /
• v.5 no.7
• /
• pp.173-180
• /
• 2016

Since smartphones possess a variety of user information, we can derive useful data related to the case from app data analysis in the digital forensic perspective. However, it requires an appropriate forensic measure as smartphone has the property of high mobility and high possibility of data loss, forgery, and modulation. Especially the forged/modulated time-stamp impairs the credibility of digital proof and results in the perplexity during the timeline analysis. This paper provides traces of usage which could investigate whether the time-stamp has been forged/modulated or not within the range of iOS based devices.

• Journal of Korea Multimedia Society
• /
• v.15 no.2
• /
• pp.179-194
• /
• 2012

Digital image forgery is becoming a topic of great interest with regard to honesty in imaging. We can often see forged digital images in a variety of places, such as the internet, and magazines, and in images used in political ads, etc. These can reduce the reliability and factual basis of the information contained in image. Therefore, objectivity is needed to determine if the image is forged so as to prevent confusion in the viewing public. Most digital forgeries consist of image resizing, rotating including the following interpolations. To find evidence of interpolation in forged images, this paper proposes a new method for detecting digital image forgery using general interpolation factors analyzed through re-interpolation algorithm of the forged images in order to determine the differences in the patterns. Through the re-interpolation algorithm we could detect the forged region and filtering region used image retouching included to interpolation.

• Proceedings of the Korean Society of Broadcast Engineers Conference
• /
• 2008.02a
• /
• pp.187-190
• /
• 2008

디지털 영상기기의 발달과 함께 디지털 영상은 우리의 생활의 일부가 되었다. 이러한 디지털 영상이 생활의 일부가 되면서 범죄자들은 범죄현장의 흔적을 디지털 영상으로 저장하기도 하며, 디지털 영상으로 저장된 CCTV를 통하여 범죄의 현장을 재현하기도 한다[5][6]. 이러한 디지털 영상은 사건을 해결하는데 중요한 역할을 하기에 사건을 수사하는데 있어 수집하여야 할 중요한 대상중의 하나이다. 이러한 디지털 영상은 하나의 분석대상에 다수의 파일로 존재할 수 있으며, 이러한 다수의 디지털 영상 속에서 사건 해결에 도움을 줄 수 있는 중요한 영상을 구분하기 위해서는 많은 시간과 인력이 필요하다. 따라서 다수의 영상 증거물을 디지털 영상 포렌식의 한 분야인 디지털 영상 분류기법을 통하여 수사의 편리함과 정확성을 향상시켜야 할 필요가 있다. 하지만 디지털 영상의 수사를 돕기 위한 디지털 영상의 분류기법은 디지털 영상 포렌식의 영역 중에서 연구가 이루어져 있지 않은 영역중의 하나이며, 연구가 진행되고 있는 방식도 국내가 아닌 국외의 법과 수사 환경을 중심으로 연구되어지고 있다. 따라서 국내의 법과 수사 환경에 적용할 수 있는 디지털 영상 분류기법에 대하여 연구할 필요성이 있다. 이에 대해 본 논문에서는 디지털 영상 포렌식 중 하나의 분야인 디지털 영상 분류기법의 연구현황을 확인하며, 디지털 영상 분류기법의 필요성에 대하여 설명하도록 하겠다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.26 no.1
• /
• pp.109-115
• /
• 2016

Nowadays, smart devices are the target of the digital forensic investigation. Among various smart devices, we can obtain much information from smart phone which is provided with continuous power and used for data communication. This paper deals with the traces to be left in Android smart phones after using the navigation applications with the GPS function. We selected navigation applications(domestic and overseas) which have a high number of download times, anaylzed them and discussed the meaning of the analysis result in digital forensic investigation.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2009.04a
• /
• pp.1493-1496
• /
• 2009

컴퓨터 및 인터넷의 사용이 증가하여 일반인들 생활에 많은 부분을 차지함에 따라 범죄의 단서가 컴퓨터에 저장되어 있는 경우가 늘고 있으며, 컴퓨터 및 인터넷 자체가 새로운 범죄의 대상이 되기도 한다. 이러한 컴퓨터 및 저장매체에 저장되어 있는 증거는 기존의 증거와 구분하여 디지털 증거라 한다. 디지털 증거는 기존의 증거와는 달리 일반적으로 내용의 변경 및 훼손이 쉬우며, 관리자의 별다른 인식 없이도 수시로 또는 자동적으로 변경될 수도 있고, 또 그 흔적이 전혀 남지 않을 수도 있다. 기래서 디지털 증거의 증거능력을 인정하는 문제에 있어서 아날로그 증거와는 달리 무결성의 법적, 기술적 보장이 필요하다. 이에 본 논문에서는 디지털 증거가 법적인 증거능력을 갖기 위한 조건을 '일심회' 사건의 예로 알아본다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.26 no.2
• /
• pp.387-396
• /
• 2016

As the number of people using digital devices has increased, the digital forensic, which aims at finding clues for crimes in digital data, has been developed and become more important especially in court. Together with the development of the digital forensic, the anti-forensic which aims at thwarting the digital forensic has also been developed. As an example, with anti-forensic technology the criminal would delete an digital evidence without which the investigator would be hard to find any clue for crimes. In such a case, recovery techniques on deleted or damaged information will be very important in the field of digital forensic. Until now, even though EVTX(event log)-based recovery techniques on deleted files have been presented, but there has been no study to retrieve event log data itself, In this paper, we propose some recovery algorithms on deleted or damaged event log file and show that our recovery algorithms have high success rate through experiments.

• Journal of Internet of Things and Convergence
• /
• v.7 no.3
• /
• pp.1-8
• /
• 2021

With the rapid increase in the use of IoT and mobile devices, cyber criminals targeting IoT devices are also on the rise. Among IoT devices, when using a wireless access point (AP), problems such as packets being exposed to the outside due to their own security vulnerabilities or easily infected with malicious codes such as bots, causing DDoS attack traffic, are being discovered. Therefore, in this study, in order to actively respond to cyber attacks targeting IoT devices that are rapidly increasing in recent years, we proposed a method to collect traces of intrusion incidents artifacts from IoT devices, and to improve the validity of intrusion analysis data. Specifically, we presented a method to acquire and analyze digital forensics artifacts in the compromised system after identifying the causes of vulnerabilities by reproducing the behavior of the sample IoT malware. Accordingly, it is expected that it will be possible to establish a system that can efficiently detect intrusion incidents on targeting large-scale IoT devices.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2014.11a
• /
• pp.466-469
• /
• 2014

기존 Window8 Style 에 대한 디지털 포렌식 연구는 윈도우 기본 애플리케이션에 대해서만 진행되어 있는 상황이고, 다른 3rd party Style App 들에 대해서만 진행되어있는 상황이다. 본 논문에서는 Window8 Style UI 의 Instant Messengers 에 대해 디지털 포렌식 분석하고 이를 통해 범인의 행동 흐름 파악 및 증거확보 매커니즘을 제시하고자 한다. 본 논문은 기존의 Window8 의 접근방법을 토대로 하여, Style App 의 사용흔적이나 내용에 대해 확인하며, 시간정보, 이미지 등 각종 애플리케이션들을 다각적으로 분석한다. 본 논문에서 제안한 접근법은 개별 App 들에 대한 정보를 효율적이고 빠르게 분석하고 사건에 대한 정보를 제공함으로써 범죄수사과정에 도움이 될 것으로 기대된다.

• KIPS Transactions on Computer and Communication Systems
• /
• v.6 no.7
• /
• pp.307-314
• /
• 2017

Stick-PC is small and portable, So it can be used like a desktop if you connect it to a display device such as a monitor or TV anytime and anywhere. Accordingly, Stick-PC can related to various crimes, and various evidence may remain. Stick-PC uses the same Windows version of the operating system as the regular Desktop, the artifacts to be analyzed are the same. However, unlike the Desktop, it can be used as a meaningful information for forensic investigation if it is possible to identify the actual user and trace the usage by finding the traces of peripheral devices before analyzing the system due to the mobility. In this paper, We presents a method of collecting images using Bootable OS, which is one of the image collection methods of Stick-PC. In addition, we show how to analyze the trace of peripheral connection and network connection trace such as Display, Bluetooth through the registry and event log, and suggest the application method from the forensic point of view through experimental scenario.