• Convergence Security Journal
• /
• v.23 no.1
• /
• pp.97-107
• /
• 2023

With the popularization of digital devices in the era of the 4th industrial revolution and the increase in cyber crimes targeting them, the importance of securing digital data evidence is emerging. However, the difficulty in securing digital data evidence is due to the use of anti-forensic techniques that increase analysis time or make it impossible, such as manipulation, deletion, and obfuscation of digital data. Such anti-forensic is defined as a series of actions to damage and block evidence in terms of digital forensics, and is classified into data destruction, data encryption, data concealment, and data tampering as anti-forensic techniques. Therefore, in this study, anti-forensic techniques are categorized into data concealment and deletion (obfuscation and encryption), investigate and analyze recent research trends, and suggest future anti-forensic research directions.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.24 no.1
• /
• pp.107-122
• /
• 2014

The DDoS attacks and the APT attacks occurred by the zombie computers simultaneously attack target systems at a fixed time, caused social confusion. These attacks require many zombie computers running attacker's commands, and unknown malware that can bypass detecion of the anti-virus products is being executed in those computers. A that time, many methods have been proposed for the detection of unknown malware against the anti-virus products that are detected using the signature. This paper proposes a method of unknown malware detection using digital forensic techniques and describes the results of experiments carried out on various samples of malware and normal files.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.25 no.5
• /
• pp.1059-1065
• /
• 2015

Hard disk passwords are commonly not well known. If the passwords are set, forensic investigators are not allowed to access data on hard disks, so they can be used to obstruct investigations. Expensive tools such as PC-3000 are necessary for unlocking such hard disk passwords. But it would be a burden on both organizations that should pay for these tools and forensic investigators that are unfamiliar with these tools. This paper discusses knowledge required for unlocking hard disk passwords and proposes methods for unlocking the passwords without high-priced tools. And with a vendor-specific method, this paper provides procedures for acquiring passwords and unlocking hard disk drives.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.25 no.3
• /
• pp.573-583
• /
• 2015

Amcache.hve file is a registry hive file regarding Program Compatibility Assistant, which stores the executed information of applications. With Amcache.hve file, We can know execution path, first executed time as well as deleted time. Since it checks both the first install time and deleted time, Amcache.hve file can be used to draw up the overall timeline of applications when used with the Prefetch files and Iconcache.db files. Amcache.hve file is also an important artifact to record the traces of anti-forensic programs, portable programs and external storage devices. This paper illustrates the features of Amcache.hve file and methods for utilization in digital forensics such as estimation of deleted time of applications.

• Journal of the Korea Society of Computer and Information
• /
• v.23 no.8
• /
• pp.75-84
• /
• 2018

In this research, a bit correction technique of data hiding method in timestamp of MFT entry in NTFS file system is proposed. This method is proposed in two ways, depending on the number of bytes of data to hide. A basic data hiding method using a bit correction technique to solve the problems of the conventional 2-byte technique is proposed. In order to increase the capacity of the data, a 3-byte data hiding method using an extended bit correction technique is proposed. The data hiding method in the timestamps is based on the fact that is not revealed in the Windows explorer window and the command prompt window even if any data is hidden in the timestamp area of less than one second. It is shown that the validity of the proposed method through the experimental two cases of the basic data hiding method by the bit correction method and the 3-byte data hiding method by the extended bit correction method.

• Proceedings of the Korean Society of Broadcast Engineers Conference
• /
• 2019.11a
• /
• pp.58-60
• /
• 2019

Double JPEG compression detection is one of the most important ways of exposing the integrity of the JPEG image in image forensics. Several methods have been proposed for discriminating against the double JPEG image. In this paper, we propose a new method for restoring the JPEG compressed image and making the detector confused by introducing a Generative Adversarial Network (GAN). First, a generator network is designed for restoring the JPEG compressed image and analyzed the quality. Then, the restored image is tested with the double compression detector for evaluating the robustness of the proposed GAN model. The detection accuracy reduces from 98% to 58%.

• Proceedings of the Korean Society of Computer Information Conference
• /
• 2008.06a
• /
• pp.183-188
• /
• 2008

디지털 포렌식이 활성화 되고 수사에서 활용하는 사례가 증가함에 따라 기업과 개인을 비롯한 범죄혐의자들의 이에 대응하기 위한 기술도 증가하고 있다. 이를 안티포렌식 또는 항포렌식이라고 하는데 이는 디지털 자료의 변조, 파괴, 은닉 등으로 나누어 볼 수 있다. 본 논문에서는 범죄 수사현장에서 필요한 안티포렌식에 대응하는 기술인 위 변조된 데이터 추출 기법, 슬랙 영역의 숨겨진 데이터 추출 기법, 스테카노 그래픽 추출 및 분석 기법, 암호 복호화 기법, 삭제된 데이터 및 파괴된 데이터 복원 기법을 소개하고, 이에 대한 대비책을 제시한다. 본 연구를 통하여 첨단 범죄 수사관들이 안티디지털포렌식에 대한 새로운 디지털 증거의 추출과 분석에 기여하여 컴퓨터 및 첨단 범죄에 대한 디지털 포렌식 기술로 새로운 수사의 방향을 제시 할 수 있을 것이다.

• Journal of the Korean Ceramic Society
• /
• v.56 no.5
• /
• pp.421-434
• /
• 2019

We face many fascinating and diverse challenges, the most important among which is to determine how to store a large amount of information with novel approaches. Info-convergence ceramic nanosystems, which combine ceramic materials science and information technology, may provide an attractive alternative. This review considers recent multidisciplinary advances in the development of info-convergence nanosystems based on ceramic materials and discusses various strategies under ceramic-based information systems with a special focus on materials and nanohybridization technologies. Ceramic materials have played diverse roles not only as the generic coding support, but also as the central coding substance. The review highlights the ceramic nanohybrid bio code and ceramic nanoparticle optical code for applications in tracking-and-traceability management, nano-forensics, anti-counterfeiting, and even communication, as well as the four steps of encoding, encrypting, decrypting, and decoding for the desired applications. Additionally, associated challenges, potential solutions, and perspectives for future developments in the field are discussed.

• Journal of Information Processing Systems
• /
• v.18 no.3
• /
• pp.402-410
• /
• 2022

Digital data can be manipulated easily, so information related to the timestamp is important in establishing the reliability of the data. The time values for a certain file can be extracted following the analysis of the filesystem metadata or file internals, and the information can be utilized to organize a timeline for a digital investigation. Suppose the reversal of a timestamp is found on a mobile device during this process. In this case, a more detailed analysis is required due to the possibility of anti-forensic activity, but little previous research has investigated the handling and possible manipulation of timestamps on mobile devices. Therefore, in this study, we determine how time values for multimedia files are handled according to the operating system or filesystem on mobile devices. We also discuss five types of timestamps-file created (C), last modified (M), last accessed (A), digitalized (Di), and filename (FN) of multimedia files, and experimented with their operational features across multiple devices such as smartphones and cameras.

• Annual Conference of KIPS
• /
• 2022.05a
• /
• pp.560-563
• /
• 2022

인공지능 기반의 딥페이크(Deepfakes) 기술이 사회적인 이슈로 대두되고 있다. 하지만 기존 딥페이크 탐지기는 sharpening, additive noise와 같은 간단한 이미지 변형만으로 탐지 우회가 가능한 문제점이 있다. 본 논문에서는 안티 포렌식에 강인한 딥페이크 탐지기를 개발하기 위해 이미지 편집 도구 기반의 안티 포렌식 데이터셋을 생성하고 적대적 학습을 수행하는 방법을 제안한다. 실험 결과를 통해 안티 포렌식에 취약한 기존 딥페이크 탐지기 성능이 제안한 적대적 학습 기법을 수행한 이후에 탐지율이 크게 개선된 것을 확인할 수 있었다.