• Journal of Korea Society of Industrial Information Systems
• /
• v.15 no.4
• /
• pp.39-45
• /
• 2010

Because of portable storage device's technical improvement, it's speeding up the conversion of mass storage. It means it's easier to move and save data. Generally, USB is using for portable storage device and forensic perspective, it's possible us to study data drain through portable storage device under securement of using vestige of USB. If we can secure using vestige of USB from boot domain it's possible to investigate data drain & prove criminal act. This thesis is suggesting Key/Thumb drive & USB Drive Enclosure's confirmation of using or not and division way though Disk Signature analysis.

• Journal of Korea Society of Industrial Information Systems
• /
• v.16 no.2
• /
• pp.59-64
• /
• 2011

A lot of computer users use external memory device. But, same time file efflux incidents are also increasing. There are two ways people use for efflux file. One is moving it after checking file which is running on computer and the other is checking file name only. Checking from running file case, we can identify vestige with running information of applied program but, the case of moving as external device without running file there is no evidence running applied program. So there are a lot of difficulty with forensic investigation. In this paper we suggest the way to help forensic investigation which is method of getting external memory device information of volume and time through its awareness method and connection information and moving to external device without running file after compare the external memory device volume information through link file analysis and getting information of link file formation & access time from link file.