• Journal of Information Science Theory and Practice
• /
• v.11 no.4
• /
• pp.14-39
• /
• 2023

Cybercrime is a significant threat to Internet users, involving crimes committed using computers or computer networks. The landscape of cyberspace presents a complex terrain, making the task of tracing the origins of sensitive data a formidable and often elusive endeavor. However, tracing the source of sensitive data in online cyberspace is critically challenging, and detecting cyber-criminals on the other hand remains a time-consuming process, especially in social networks. Cyber-criminals target individuals for financial gain or to cause harm to their assets, resulting in the loss or theft of millions of user data over the past few decades. Forensic professionals play a vital role in conducting successful investigations and acquiring legally acceptable evidence admissible in court proceedings using modern techniques. This study aims to provide an overview of forensic investigation methods for extracting digital evidence from computer systems and mobile devices to combat persistent cybercrime. It also discusses current cybercrime issues and mitigation procedures.

• Journal of information and communication convergence engineering
• /
• v.20 no.4
• /
• pp.280-287
• /
• 2022

Recently, the number of mobile ransomware types has increased. Moreover, the number of cases of damage caused by mobile ransomware is increasing. Representative damage cases include encrypting files on the victim's smart device or making them unusable, causing financial losses to the victim. This study classifies ransomware apps by analyzing several representative ransomware apps to identify trends in the malicious behavior of ransomware. We present a technique for recovering from the damage, from a digital forensic perspective, using reverse engineering ransomware apps to analyze vulnerabilities in malicious functions applied with various cryptographic technologies. Our study found that ransomware applications are largely divided into three types: locker, crypto, and hybrid. In addition, we presented a method for recovering the damage caused by each type of ransomware app using an actual case. This study is expected to help minimize the damage caused by ransomware apps and respond to new ransomware apps.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.33 no.4
• /
• pp.647-659
• /
• 2023

As digital evidence becomes more important in criminal investigations, disputes are increasing in court. As media diversifies and the scope of analysis expands, the level of expertise in digital forensics is also increasing. However, no competency model has been developed to define the capabilities of digital evidence examiners or to judge their expertise. There have been some studies that have derived the capabilities necessary for digital evidence examiner, but they are still insufficient. Therefore, in this study, 25 competency evaluation factors in a total of 9 competency groups were defined using methodologies such as expert FGI and Delphi survey. Specifically, it was defined as Digital Forensics Theory, Digital Evidence Collection&Management, Disk Forensics, Mobile Forensics, Video Forensics, infringement forensics, DB Forensics, Embedded(IoT) Forensics, and Cloud Forensics. The digital evidence examiner competency model is expected to be used in various fields such as recruitment, education and training, and performance evaluation in the future.

• Journal of the Korea Society of Computer and Information
• /
• v.11 no.6 s.44
• /
• pp.175-184
• /
• 2006

Computer Forensics functions by defending the effects and extracting the evidence of the side effects for production at the court. Has the faultlessness of the digital evidence been compromised during the investigation, a critical evidence may be denied or not even be presented at the trial. The presented monograph will deliberate the faultlessness-establishing chain procedures in disk forensics, system forensics, network forensics, mobile forensics and database forensics. Once the faultlessness is established by the methods proposed, the products of investigation will be adopted as a leading evidence. Moreover, the issues and alternatives in the reality of digital investigation are presented along with the actual computer forensics cases, hopefully contributing to the advances in computer digital forensics and the field research of information security.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.23 no.6
• /
• pp.1057-1067
• /
• 2013

The market share of smartphones has been increasing more and more at the recent mobile market and smart devices and applications that are based on a variety of operating systems has been released. Given this reality, the importance of smart devices analysis is coming to the fore and the most important thing is to minimize data corruption when extracting data from the device in order to analyze user behavior. In this paper, we compare and analyze the area-specific changes that are the file system of collected image after obtaining root privileges on the Android OS and iOS based devices, and then propose the most efficient method to obtain root privileges.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2012.05a
• /
• pp.463-466
• /
• 2012

Smartphones along with the development of crime evidence has been using smartphones. Phone's internal storage medium can be used as evidence in the case of images, video, phone, GPS information, there are Internet access and other data records. Therefore, these data to collect evidence of a systematic procedure for collecting and analyzing evidence is needed. In this paper, the target mobile phone forensics forensic evidence collection, evidence analysis, and reporting results to the procedures and how to draw. Through this paper, phone forensics and will serve as a basis for the investigation.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.19 no.5
• /
• pp.151-166
• /
• 2009

To prove the integrity of digital evidence on the investigation procedure, the data which is using the MD 5(Message Digest 5) hash-function algorithm has to be discarded, if the integrity was damaged on the investigation. Even though a proof restoration of the deleted area is essential for securing the proof regarding a main phase of a case, it was difficult to secure the decisive evidence because of the damaged evidence data due to the difference between the overall hash value and the first value. From this viewpoint, this paper proposes the novel model for the mobile forensic procedure, named as "E-Finder(Evidence Finder)", to ,solve the existing problem. The E-Finder has 5 main phases and 15 procedures. We compared E-Finder with NIST(National Institute of Standards and Technology) and Tata Elxsi Security Group. This paper thus achieved the development and standardization of the investigation methodology for the mobile forensics.

• Journal of Korea Society of Digital Industry and Information Management
• /
• v.6 no.3
• /
• pp.79-89
• /
• 2010

Cellular and Smart phone through the business and real life is associated with an increasing number of information processing, Breaches associated with mobile terminal Tile has occurred and cause Crime and damage. In this paper, Cellular and Smart phone for mobile forensics SYN scheme and JTAG scheme to target Cellular and Smart phone for the extraction of forensic data will be studied. SYN, JTAG approach to forensic analysis indicate with the process, Every Smart phone's OS specific performance and data extraction were compared. In the laboratory, Cell and smart phone with the SYN scheme and JTAG scheme to extract forensic data Improvement compared to the extraction is presented.

• Journal of Information Processing Systems
• /
• v.18 no.3
• /
• pp.402-410
• /
• 2022

Digital data can be manipulated easily, so information related to the timestamp is important in establishing the reliability of the data. The time values for a certain file can be extracted following the analysis of the filesystem metadata or file internals, and the information can be utilized to organize a timeline for a digital investigation. Suppose the reversal of a timestamp is found on a mobile device during this process. In this case, a more detailed analysis is required due to the possibility of anti-forensic activity, but little previous research has investigated the handling and possible manipulation of timestamps on mobile devices. Therefore, in this study, we determine how time values for multimedia files are handled according to the operating system or filesystem on mobile devices. We also discuss five types of timestamps-file created (C), last modified (M), last accessed (A), digitalized (Di), and filename (FN) of multimedia files, and experimented with their operational features across multiple devices such as smartphones and cameras.

• Journal of Digital Forensics
• /
• v.12 no.3
• /
• pp.1-8
• /
• 2018

A random chat application is a type of social dating application that helps people find a lover or spouse by randomly connecting and providing services such as text, voice and video chat. Recently, there has been globally a rapid increase in its use due to the fact that it provides people to quick and convenient encounters at low cost. However, it is used as one of method to prostitute or to trade drugs and become a cause of violent crimes due to various criminal occurring after actual meeting between app users. For this reason, a random chat application is likely to provide proof of prostitution or drug trade and clues to arrest rape, kidnapping and murder suspects. Thus, it is necessary to analyse random chat applications from the viewpoint of digital forensics investigation, but there is no related research at all. Therefore, in this paper, we analyzed artifacts of 6 Korea random chat application's user behaviors; Ranchat, AngTalk, SsumgThing, DaTalk, EveryTalk and Sail. As a result, we found that it is remain on mobile device that time and contents of message transmission/reception, sender/receiver, friend profile and user account creation time when user is using the applications.