• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.34 no.2
• /
• pp.193-206
• /
• 2024

In tandem with the advancements in the digital era, the significance of digital data has escalated, necessitating an increased focus on digital forensics investigations. However, the process of collecting and analyzing digital evidence faces significant challenges, such as the unidentifiability of damaged files due to issues like media corruption and anti-forensic techniques. Moreover, the technological limitations of existing tools hinder the recovery of damaged files, posing difficulties in the evidence collection process. This paper aims to propose solutions for the recovery of corrupted MS Office files commonly used in digital data creation. To achieve this, we analyze the structure of MS Office files in the OOXML format and present a novel approach to overcome the limitations of current recovery tools. Through these efforts, we aim to contribute to enhancing the quality of evidence collection in the field of digital forensics by efficiently recovering and identifying damaged data.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.13 no.8
• /
• pp.4005-4025
• /
• 2019

Copy-move forgery (CMF) in digital images is a detrimental tampering of artefacts that requires precise detection and analysis. CMF is performed by copying and pasting a part of an image into other portions of it. Despite several efforts to detect CMF, accurate identification of noise, blur and rotated region-mediated forged image areas is still difficult. A novel algorithm is developed on the basis of quaternion polar complex exponential transform (QPCET) to detect CMF and is conducted involving a few steps. Firstly, the suspicious image is divided into overlapping blocks. Secondly, invariant features for each block are extracted using QPCET. Thirdly, the duplicated image blocks are determined using k-dimensional tree (kd-tree) block matching. Lastly, a new technique is introduced to reduce the flat region-mediated false matches. Experiments are performed on numerous images selected from the CoMoFoD database. MATLAB 2017b is used to employ the proposed method. Metrics such as correct and false detection ratios are utilised to evaluate the performance of the proposed CMF detection method. Experimental results demonstrate the precise and efficient CMF detection capacity of the proposed approach even under image distortion including rotation, scaling, additive noise, blurring, brightness, colour reduction and JPEG compression. Furthermore, our method can solve the false match problem and outperform existing ones in terms of precision and false positive rate. The proposed approach may serve as a basis for accurate digital image forensic investigations.

• Journal of IKEEE
• /
• v.26 no.4
• /
• pp.681-685
• /
• 2022

Including the COVID-19 crisis, humanity is constantly exposed to viral infections, and efforts are being made to prevent the spread of infection by quickly isolating infected people and tracing contacts. Passive epidemiological investigations that confirm contact with an infected person through contact have limitations in terms of accuracy and speed, so automatic tracking methods using various digital technologies are being proposed. This paper verify contact by utilizing Bluetooth Low Energy (BLE) technology and present an algorithm that identifies close contact through analysis and correction of RSSI (Received Signal Strength Indicator) values. Also, propose a system that can prevent the spread of viruses in a centralized server structure.

• Proceedings of the Korean Society of Computer Information Conference
• /
• 2023.07a
• /
• pp.203-205
• /
• 2023

소셜미디어 사용이 증가하면서 성 착취물, 불법 촬영물과 같은 디지털 성범죄 또한 확산되는 추세이다. 소셜미디어에서 검색어 차단 정책 등을 통해 디지털 성범죄를 제재하기 위한 노력이 이루어지고 있으나, 은어 및 다양한 변형어를 사용한 우회 검색을 모두 차단하는 것이 어려울 뿐 아니라, 단시간에도 방대한 양의 데이터가 생성되는 소셜미디어 특성상 범죄 관련 게시글을 모두 식별해 내는 것이 현실적으로 불가능하다. 따라서 능동적이고 고도화된 크롤링 기술 개발을 통해 소셜미디어상의 범죄를 실시간 탐지하는 연구가 필요하다. 본 논문에서는 디지털 성범죄 관련 데이터가 빈번하게 관찰되는 트위터를 대상으로 성 착취물 및 불법 촬영물 정보를 수집하기 위한 검색 키워드를 정의하고, 실제 트위터 크롤링을 수행하여 텔레그램, 디스코드, 라인 등과 같은 다른 소셜미디어에 성범죄물이 유포되는 정황을 URL, 코드, 해시태그 추출을 통해 확보하는 수사 기술을 개발한다.

• Journal of Digital Convergence
• /
• v.19 no.2
• /
• pp.231-238
• /
• 2021

SNS data can catch the user's thoughts and actions. And the trend of the search portal is a representative service that can observe the interests of users and their changes. In this paper, the relationship was analyzed by comparing statistics on narcotics incidents and the degree of exposure to narcotics related words in tweets of SNS and in the trends of search portal. It was confirmed that the trend of SNS and search portal trends was the same in the statistics of the prosecution office with a certain time difference.In addition, cluster analysis was performed to understand the meaning of tweets in which narcotics related words were mentioned. In the 50,000 tweets collected in January 2020, it was possible to find meaning related to the sale of actual drugs. Therefore, through SNS monitoring alone it is possible to monitor narcotics-related incidents and to find specific sales or purchase-related information, and this can be used in the investigation process. In the future, it is expected that crime monitoring and prediction systems can be proposed as related crime analysis may be possible not only with text but also images.

• Convergence Security Journal
• /
• v.22 no.2
• /
• pp.121-130
• /
• 2022

Recently, as soldiers are allowed to use mobile phones, cases are frequently transferred from the police to the military due to criminal acts, and digital evidence is collected separately from the reliability of previous investigations, such as overlapping seizure and search procedures. In this study, through in-depth interviews with practitioners in charge of digital evidence in the military, police, and courts, problems related to digital evidence handling, such as infringement of evidence ability due to overlapping human factors and procedures, are derived and analyzed. The presented procedure verified the effectiveness of the procedure through case analysis, and is expected to contribute to the guarantee of the evidence capacity of digital evidence and the efficiency of handling cases.

• Imaging Science in Dentistry
• /
• v.48 no.3
• /
• pp.167-176
• /
• 2018

Purpose: In the age of X-ray computed tomography (CT) and digital volume tomography (DVT), with their outstanding post-processing capabilities, indications for planar radiography for the study of the dentition of ancient Egyptian mummies may easily be overlooked. In this article, the advantages and limitations of different approaches and projections are discussed for planar oral and maxillofacial radiography using portable digital X-ray equipment during archaeological excavations. Furthermore, recommendations are provided regarding projections and sample positioning in this context. Materials and Methods: A total of 55 specimens, including 19 skeletonized mandibles, 14 skeletonized skulls, 18 separate mummified heads, and 4 partially preserved mummies were imaged using portable digital X-ray equipment in the course of archaeological excavations led by the University of Basel in the Valley of the Kings between 2009 and 2012. Images were evaluated by 2 authors with regard to the visibility of diagnostically relevant dental structures using a 4-point grading system(Likert scale). Results: Overall, the visibility of diagnostically relevant dental structures was rated highest by both authors on X-ray images acquired using a dental detector. The tube-shift technique in the lateral projections of mandibular dentition achieved the second-best rating, and lateral projections achieved the third-best rating. Conclusion: Conventional planar digital X-ray imaging, due to its ubiquity, remains an excellent method-and often the only practicable one-for examining the skulls and teeth of ancient Egyptian mummies under field conditions. Radiographic images of excellent diagnostic quality can be obtained, if an appropriate methodology regarding the selected projections and sample placement is followed.

• Journal of Platform Technology
• /
• v.11 no.4
• /
• pp.35-49
• /
• 2023

Recently, real-time cyber threats are constantly occurring for various reasons. Most companies have the characteristic of digitizing important internal information and storing it centrally, so it can be said that the impact is very high when an Computer Security Incident occurs. All electronic device information collected and analyzed in the process of responding to an Computer Security Incident has the characteristic of being subject to change at any time. Submission of related evidence is required in future investigations and courts. At this time, the basic principles of digital forensics, such as the principle of integrity and the principle of chain of custody, must be followed to ensure legitimacy and accuracy of the evidence. In this paper, we propose a digital forensic-based Computer Security Incident Inspection and Response procedure in the Windows 10 environment to secure the legitimacy and accuracy of digital evidence collected and analyzed when an intrusion occurs, prevent intrusion in advance, and quickly recognize it.

• Journal of Convergence for Information Technology
• /
• v.10 no.5
• /
• pp.23-29
• /
• 2020

These days, digital forensic technologies are being used frequently at crime scenes. There are various electronic devices at the scene of the crime, and digital forensic results of these devices are used as important evidence. In particular, the user's action and the time when the action took place are critical. But there are many limitations for use in real forensics analyses because of the short cycle in which user actions are recorded. This paper proposed an efficient method for recovering deleted user behavior records and applying them to forensics investigations, then the proposed method is compared with previous methods. Although there are difference in recovery result depending on the storage, the results have been identified that the amount of user history data is increased from a minimum of 6% to a maximum of 539% when recovered user behavior was utilized to forensics investigation.

• Journal of Information Processing Systems
• /
• v.14 no.3
• /
• pp.680-693
• /
• 2018

Nowadays, third-party applications form an important part of the mobile environment, and social networking applications in particular can leave a variety of user footprints compared to other applications. Digital forensics of mobile third-party applications can provide important evidence to forensics investigators. However, most mobile operating systems are now updated on a frequent basis, and developers are constantly releasing new versions of them. For these reasons, forensic investigators experience difficulties in finding the locations and meanings of data during digital investigations. Therefore, this paper presents scenario-based methods of forensic analysis for a specific third-party social networking service application on a specific mobile device. When applied to certain third-party applications, digital forensics can provide forensic investigators with useful data for the investigation process. The main purpose of the forensic analysis proposed in the present paper is to determine whether the general use of third-party applications leaves data in the mobile internal storage of mobile devices and whether such data are meaningful for forensic purposes.