• Proceedings of the Korean Society of Computer Information Conference
• /
• 2012.07a
• /
• pp.217-219
• /
• 2012

안드로이드 기기 보급률 증가에 따라 컴퓨터 포렌식 분야에서는 안드로이드 기기에 대한 증거수집 및 분석의 필요성이 강하게 제기되고 있지만, 아직까지 연구는 미진한 상태이다. 또한 컴퓨터 포렌식 도구들에 의지하여 증거를 수집하고 분석하는 실정이다. 하지만 개인의 모든 정보가 거의 들어 있다고 해도 과언이 아닌 스마트폰의 정보유출은 우리의 일상에서 쉽고 빈번하게 발생할 수 있는데, 포렌식 분석 툴을 이용하여 증거를 수집하거나 분석하기란 쉽지 않은 일이다. 본 논문에서는 포렌식 분석 툴을 이용하지 않고 개인의 정보 유출 유무를 판단하여 대응할 수 있는 방법을 제시한다.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2013.11a
• /
• pp.857-860
• /
• 2013

스마트폰의 다양하고 편리한 기능은 휴대전화기 시장의 급속한 성장을 이루어 최근에는 3000만 사용자 수를 넘어서고 있지만, 악성코드와 같은 공격으로 인한 보안 사고 또한 증가하고 있다. 개방성을 지향하는 안드로이드 플랫폼에서는 스미싱과 같은 신종 공격으로 인해 보안 사고가 최근 크게 이슈가 되고 있는 상황이다. 이러한 취약성을 보완하기 위해 기존 스마트폰 운영체제와 별도의 도메인을 분리하여 금융거래나 사용자의 중요 정보는 별도의 보안 운영체제에서 처리하는 모바일 가상화 기술이 대두되고 있다. 향후 이러한 모바일 가상화 기술이 대중화될 경우, 일반적인 포렌식 조사 절차로는 현장에서 확보한 스마트폰의 보안 영역에서는 사건 조사에 필요한 증거 수집이 불가능할 수 있다. 따라서 본 논문에서는 최근의 모바일 가상화 기술을 살펴보고, 이를 바탕으로 가상화 플랫폼 기반 모바일 장비의 포렌식 조사 방안에 대해 살펴보고자 한다.

• KIPS Transactions on Computer and Communication Systems
• /
• v.6 no.1
• /
• pp.31-42
• /
• 2017

Thumbnail, the small sized graphic file such as JPEG or GIF, serves to help the users to be recognized as a rapidly helps to make it easier recognize while browsing the large sized graphic file. Gallery application, which is installed in a later version of the 4.4.x(Kitkat) Android smartphone records the generated time of graphic file in thumbnail metadata. Thumbnail can be used to draw up the timeline of user action about user's action such as creation, modification, deletion with original graphic file analysis. Also, take advantage of the features thumbnails are stored sequentially in a single thumbcache file, even if the thumbcache is deleted, we can restore the thumbnails. This paper illustrates the feature of thumbnail created by Android OS basic gallery app and methods for utilization in digital forensics.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.17 no.6
• /
• pp.1360-1364
• /
• 2013

Internet phone, communication cost and easy-to-use low-cost compared to the PSTN is a mobile phone of a conventional, and use of the Internet phone is spreading. Construction as part of the broadband convergence network(BCN), Internet service provider(KT, SKT, LGU+) has converted to Internet phone telephone network to all government agencies. In addition, members of the public also have an Internet phone service that you are using. In this paper, we analyze the hacking attack on IP-PBX in the IETF SIP-based that are used in Internet telephony, to the study. The test bed is constructed in the same way as the Internet telephone system to perform studies carried hacking attacks on IP-PBX, analyze the results and to extract evidence forensics. When used in crime by hacking the Internet telephone, we propose a method which can be used as evidence in forensic having legal effect.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2013.05a
• /
• pp.197-200
• /
• 2013

Internet phone, communication cost and easy-to-use low-cost compared to the PSTN is a mobile phone of a conventional, and use of the Internet phone is spreading. Construction as part of the broadband convergence network(BCN), Internet service provider(KT, SKT, LG) has converted to Internet phone telephone network to all government agencies. In addition, members of the public also have an Internet phone service that you are using. In this paper, we analyze the hacking attack on IP-PBX in the IETF SIP-based that are used in Internet telephony, to the study. The test bed is constructed in the same way as the Internet telephone system to perform studies carried hacking attacks on IP-PBX, analyze the results and to extract evidence forensics. When used in crime by hacking the Internet telephone, we propose a method which can be used as evidence in forensic having legal effect.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.33 no.4
• /
• pp.647-659
• /
• 2023

As digital evidence becomes more important in criminal investigations, disputes are increasing in court. As media diversifies and the scope of analysis expands, the level of expertise in digital forensics is also increasing. However, no competency model has been developed to define the capabilities of digital evidence examiners or to judge their expertise. There have been some studies that have derived the capabilities necessary for digital evidence examiner, but they are still insufficient. Therefore, in this study, 25 competency evaluation factors in a total of 9 competency groups were defined using methodologies such as expert FGI and Delphi survey. Specifically, it was defined as Digital Forensics Theory, Digital Evidence Collection&Management, Disk Forensics, Mobile Forensics, Video Forensics, infringement forensics, DB Forensics, Embedded(IoT) Forensics, and Cloud Forensics. The digital evidence examiner competency model is expected to be used in various fields such as recruitment, education and training, and performance evaluation in the future.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.30 no.3
• /
• pp.369-378
• /
• 2020

Due to the widespread use of mobile devices, smartphone penetration and usage rate continue to increase and there is also an increasing amount of data that need to be stored and managed in applications. Therefore, recent applications use mobile databases to store and manage user data. Realm database, developed in 2014, is attracting more attention from developers because of advantages of continuous updating, high speed, low memory usage, simplicity and readability of the code. It also supports an encryption to provide confidentiality and integrity of personal information stored in the database. However, since the encryption can be used as an anti-forensic technique, it is necessary to analyze the encryption and decryption processes provided by Realm Database. In this paper, we analyze the structure of Realm Database and its encryption and decryption process in detail, and analyze an application that supports an encryption to propose the use cases of the Realm Database.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.21 no.1
• /
• pp.167-175
• /
• 2011

As recent emergence of smart phones, mobile services are growing in various forms. Many companies released smart phones of various operating systems such as Window Mobile, Android and iOS. Currently, most popular smart phone operating systems are Android and iOS. Due to the various features of these smart phone, they can be employed to various crimes. From the point of view of digital forensics, this paper analyzes the evidence data which needs to be collected in the smart phone, and implements the evidence analysis tool. By using this tool, it can reduce the time and effort for collecting and analyzing the evidence of the smart phone.

• KSCI Review
• /
• v.14 no.2
• /
• pp.225-234
• /
• 2006

Computer Forensics functions by defending the effects and extracting the evidence of the side effects for production at the court. Has the faultlessness of the digital evidence been compromised during the investigation, a critical evidence may be denied or not even be presented at the trial. The presented monograph will deliberate the faultlessness-establishing chain procedures in disk forensics. system forensics, network forensics, mobile forensics and database forensics. Once the faultlessness is established by the methods proposed, the products of investigation will be adopted as a leading evidence. Moreover, the issues and alternatives in the reality of digital investigation are presented along with the actual computer forensics cases, hopefully contributing to the advances in computer digital forensics and the field research of information security.

• Nuclear Engineering and Technology
• /
• v.49 no.4
• /
• pp.787-791
• /
• 2017

Americium-beryllium (Am-Be; n, ${\gamma}$) is a neutron emitting source used in various research fields such as chemistry, physics, geology, archaeology, medicine, and environmental monitoring, as well as in the forensic sciences. It is a mobile source of neutron activity (20 Ci), yielding a small thermal neutron flux that is water moderated. The aim of this study is to develop a model to increase the neutron thermal flux of a source such as Am-Be. This study achieved multiple advantageous results: primarily, it will help us perform neutron activation analysis. Next, it will give us the opportunity to produce radio-elements with short half-lives. Am-Be single and multisource (5 sources) experiments were performed within an irradiation facility with a paraffin moderator. The resulting models mainly increase the thermal neutron flux compared to the traditional method with water moderator.