• Title/Summary/Keyword: Forensic Data

Search Result 377, Processing Time 0.025 seconds

A Study of Forensic on Eavesdropping from VoIP and Messenger through WiBro Network (WiBro 네트워크에서 메신저, VoIP 도청 및 포렌식 연구)

  • Chun, Woo-Sung;Park, Dea-Woo
    • Journal of the Korea Society of Computer and Information
    • /
    • v.14 no.5
    • /
    • pp.149-156
    • /
    • 2009
  • Korean WiBro becomes international standard to IEEE 802.16e, and We are carrying out a WiBro network business from capital regions. We executed eavesdropping about voices and messenger program and the VoIP which frequently happened in WiBro networks at these papers. We have a lot in common with the Wireshark which is a packet collection and an analyzer, and We execute eavesdropping, and We reproduce eavesdropping data with bases to a SIP, H.263, TCP, UDP protocol through packets. In time of a copy of a packet negative the VoIP which verify time with bases, and was eavesdropped on integrity packet and a X-Lite call record, be matched that a packet is counterfeit forgery did not work, and We demonstrate, and verify integrity. The data which integrity was verified put in a seaming envelope, and we prepare so as it is to a liver of investigator, and execute, and to be able to do use to proof data after seaming in courts in order to utilize as criminal investigation data.

A Study on Collection and Analysis of Collaboration Tool JANDI Artifacts in a Windows Environment (윈도우 환경에서의 협업 도구 잔디 아티팩트 수집 및 분석 연구)

  • Dabin We;Hangyeol Kim;Myungseo Park
    • Journal of the Korea Institute of Information Security & Cryptology
    • /
    • v.34 no.5
    • /
    • pp.915-925
    • /
    • 2024
  • As non-face-to-face work increases due to the COVID-19 pandemic, companies have introduced collaboration tools to perform work without spatial constraints. The rapidly growing collaboration tool market continues to show high utilization rates even after the endemic due to the increase in demand for hybrid work that combines face-to-face and non-face-to-face work. The use of collaboration tools increases work efficiency, facilitates smooth collaboration, and increases data integration, generating various data. However, at the same time, it also increases the risk of exposure of corporate confidential information due to the possibility of external access by internal users. In response to this, an analysis method is needed to collect and acquire data during digital investigations targeting collaboration tools. In this paper, we identified local artifacts targeting JANDI, a collaboration tool in a Windows environment, and explained how to collect and analyze data through API reconstruction. Finally, we presented a digital forensic utilization method through scenario and chat room reconstruction.

Patterns of Cancer in Kurdistan - Results of Eight Years Cancer Registration in Sulaymaniyah Province-Kurdistan-Iraq

  • Khoshnaw, Najmaddin;Mohammed, Hazha A;Abdullah, Dana A
    • Asian Pacific Journal of Cancer Prevention
    • /
    • v.16 no.18
    • /
    • pp.8525-8531
    • /
    • 2016
  • Background: Cancer has become a major health problem associated with high mortality worldwide, especially in developing countries. The aim of our study was to evaluate the incidence rates of different types of cancer in Sulaymaniyah from January-2006 to January-2014. The data were compared with those reported for other middle east countries. Materials and Methods: This retrospective study depended on data collected from Hiwa hospital cancer registry unit, death records and histopathology reports in all Sulaymaniyah teaching hospitals, using international classification of diseases. Results: A total of 8,031 cases were registered during the eight year period, the annual incidence rate in all age groups rose from 38 to 61.7 cases/100,000 population/year, with averages over 50 in males and 50.7 in females. The male to female ratio in all age groups were 0.98, while in the pediatric age group it was 1.33. The hematological malignancies in all age groups accounted for 20% but in the pediatric group around half of all cancer cases. Pediatric cancers were occluding 7% of total cancers with rates of 10.3 in boys and 8.7 in girls. The commonest malignancies by primary site were leukemia, lymphoma, brain, kidney and bone. In males in all age groups they were lung, leukaemia, lymphoma, colorectal, prostate, bladder, brain, stomach, carcinoma of unknown primary (CUP) and skin, while in females they were breast, leukaemia, lymphoma, colorectal, ovary, lung, brain, CUP, and stomach. Most cancers were increased with increasing age except breast cancer where decrease was noted in older ages. High mortality rates were found with leukemia, lung, lymphoma, colorectal, breast and stomach cancers. Conclusions: We here found an increase in annual cancer incidence rates across the period of study, because of increase of cancer with age and higher rates of hematological malignancies. Our study is valuable for Kurdistan and Iraq because it provides more accurate data about the exact patterns of cancer and mortality in our region.

Yet Another BGP Archive Forensic Analysis Tool Using Hadoop and Hive (하둡과 하이브를 이용한 BGP 아카이브 데이터의 포렌직 분석 툴)

  • Lee, Yeonhee;Lee, YoungSeok
    • Journal of KIISE
    • /
    • v.42 no.4
    • /
    • pp.541-549
    • /
    • 2015
  • A large volume of continuously growing BGP data files can raise two technical challenges regarding scalability and manageability. Due to the recent development of the open-source distributed computing infrastructure, Hadoop, it becomes feasible to handle a large amount of data in a scalable manner. In this paper, we present a new Hadoop-based BGP tool (BGPdoop) that provides the scale-out performance as well as the extensible and agile analysis capability. In particular, BGPdoop realizes a query-based BGP record exploration function using Hive on the partitioned BGP data structure, which enables flexible and versatile analytics of BGP archive files. From the experiments for the scalability with a Hadoop cluster of 20 nodes, we demonstrate that BGPdoop achieves 5 times higher performance and the user-defined analysis capability by expressing diverse BGP routing analytics in Hive queries.

Accuracy of an equation for estimating age from mandibular third molar development in a Thai population

  • Verochana, Karune;Prapayasatok, Sangsom;Janhom, Apirum;Mahasantipiya, Phattaranant May;Korwanich, Narumanas
    • Imaging Science in Dentistry
    • /
    • v.46 no.1
    • /
    • pp.1-7
    • /
    • 2016
  • Purpose: This study assessed the accuracy of age estimates produced by a regression equation derived from lower third molar development in a Thai population. Materials and Methods: The first part of this study relied on measurements taken from panoramic radiographs of 614 Thai patients aged from 9 to 20. The stage of lower left and right third molar development was observed in each radiograph and a modified Gat score was assigned. Linear regression on this data produced the following equation: Y=9.309+1.673 mG+0.303S (Y=age; mG=modified Gat score; S=sex). In the second part of this study, the predictive accuracy of this equation was evaluated using data from a second set of panoramic radiographs (539 Thai subjects, 9 to 24 years old). Each subject's age was estimated using the above equation and compared against age calculated from a provided date of birth. Estimated and known age data were analyzed using the Pearson correlation coefficient and descriptive statistics. Results: Ages estimated from lower left and lower right third molar development stage were significantly correlated with the known ages (r=0.818, 0.808, respectively, $P{\leq}0.01$). 50% of age estimates in the second part of the study fell within a range of error of ${\pm}1year$, while 75% fell within a range of error of ${\pm}2years$. The study found that the equation tends to estimate age accurately when individuals are 9 to 20 years of age. Conclusion: The equation can be used for age estimation for Thai populations when the individuals are 9 to 20 years of age.

An improved extraction technique of executable file from physical memory by analyzing file object (파일 오브젝트 분석 기반 개선된 물리 메모리 실행 파일 추출 방법)

  • Kang, Youngbok;Hwang, Hyunuk;Kim, Kibom;Noh, Bongnam
    • Journal of the Korea Institute of Information Security & Cryptology
    • /
    • v.24 no.5
    • /
    • pp.861-870
    • /
    • 2014
  • According to the intelligence of the malicious code to extract the executable file in physical memory is emerging as an import researh issue. In previous physical memory studies on executable file extraction which is targeting running files, they are not extracted as same as original file saved in disc. Therefore, we need a method that can extract files as same as original one saved in disc and also can analyze file-information loaded in physical memory. In this paper, we provide a method that executable file extraction by analyzing information of Windows kernel file object. Also we analyze the characteristic of physical memory loaded file data from the experiment and we demonstrate superiority because the suggested method can effectively extract more of original file data than the existing method.

A study on the screening of toxic materials by HPTLC and GC/MS (HPTLC 및 GC/MS를 이용한 유해화학물질의 스크리닝에 관한 연구)

  • Park, Sung-Woo;Jang, Seong-Gil;Park, You-Sin;Lee, Jin-Hoon;Lee, Sang-Ki;You, Jae-Hoon;Kim, Dong-Hwan;Jin, Kwang-Ho;Kim, Ki-Wook;Kim, Yu-Na;Lho, Dong-Seok
    • Analytical Science and Technology
    • /
    • v.13 no.1
    • /
    • pp.108-120
    • /
    • 2000
  • To perform an effective screening for toxic materials of forensic interest detected in high profile criminal case in biological and environmental samples, we tried to construct a searchable computerized database using HPTLC(High Performance Thin Layer Chromatography) and GC/MS. Retardation factor($R_f$) values and UV spectral data of HPTLC were investigated for 160 pesticides, 34 chemicals and 39 explosives of standard grade. The data were compiled in a library. We also analyzed 112 pesticides, 31 chemicals and 17 explosives and 57 volatile organic compounds(VOCs) by GC/MS. The data for RT and characteristic mass ions were also compiled in a library.

  • PDF

A Study on Traceback by WAS Bypass Access Query Information of DataBase (DBMS WAS 우회접속의 쿼리정보 역추적 연구)

  • Baek, Jong-Il;Park, Dea-Woo
    • Journal of the Korea Society of Computer and Information
    • /
    • v.14 no.12
    • /
    • pp.181-190
    • /
    • 2009
  • DBMS access that used high speed internet web service through WAS is increasing. Need application of DB security technology for 3-Tier about DBMS by unspecified majority and access about roundabout way connection and competence control. If do roundabout way connection to DBMS through WAS, DBMS server stores WAS's information that is user who do not store roundabout way connection user's IP information, and connects to verge system. To DBMS in this investigation roundabout way connection through WAS do curie information that know chasing station security thanks recording and Forensic data study. Store session about user and query information that do login through web constructing MetaDB in communication route, and to DBMS server log storing done query information time stamp query because do comparison mapping actuality user discriminate. Apply making Rule after Pattern analysis receiving log by elevation method of security authoritativeness, and develop Module and keep in the data storing place through collection and compression of information. Kept information can minimize false positives of station chase through control of analysis and policy base administration module that utilize intelligence style DBMS security client.

Estimation of reaction forces at the seabed anchor of the submerged floating tunnel using structural pattern recognition

  • Seongi Min;Kiwon Jeong;Yunwoo Lee;Donghwi Jung;Seungjun Kim
    • Computers and Concrete
    • /
    • v.31 no.5
    • /
    • pp.405-417
    • /
    • 2023
  • The submerged floating tunnel (SFT) is tethered by mooring lines anchored to the seabed, therefore, the structural integrity of the anchor should be sensitively managed. Despite their importance, reaction forces cannot be simply measured by attaching sensors or load cells because of the structural and environmental characteristics of the submerged structure. Therefore, we propose an effective method for estimating the reaction forces at the seabed anchor of a submerged floating tunnel using a structural pattern model. First, a structural pattern model is established to use the correlation between tunnel motion and anchor reactions via a deep learning algorithm. Once the pattern model is established, it is directly used to estimate the reaction forces by inputting the tunnel motion data, which can be directly measured inside the tunnel. Because the sequential characteristics of responses in the time domain should be considered, the long short-term memory (LSTM) algorithm is mainly used to recognize structural behavioral patterns. Using hydrodynamics-based simulations, big data on the structural behavior of the SFT under various waves were generated, and the prepared datasets were used to validate the proposed method. The simulation-based validation results clearly show that the proposed method can precisely estimate time-series reactions using only acceleration data. In addition to real-time structural health monitoring, the proposed method can be useful for forensics when an unexpected accident or failure is related to the seabed anchors of the SFT.

A Study on the Crime Investigation of Anonymity-Driven Blockchain Forensics (익명 네트워크 기반 블록체인 범죄 수사방안 연구)

  • Han, Chae-Rim;Kim, Hak-Kyong
    • Convergence Security Journal
    • /
    • v.23 no.5
    • /
    • pp.45-55
    • /
    • 2023
  • With the widespread use of digital devices, anonymous communication technologies such as the dark web and deep web are becoming increasingly popular for criminal activity. Because these technologies leave little local data on the device, they are difficult to track using conventional crime investigation techniques. The United States and the United Kingdom have enacted laws and developed systems to address this issue, but South Korea has not yet taken any significant steps. This paper proposes a new blockchain-based crime investigation method that uses physical memory data analysis to track the behavior of anonymous network users. The proposed method minimizes infringement of basic rights by only collecting physical memory data from the device of the suspected user and storing the tracking information on a blockchain, which is tamper-proof and transparent. The paper evaluates the effectiveness of the proposed method using a simulation environment and finds that it can track the behavior of dark website users with a residual rate of 77.2%.