• The KIPS Transactions:PartA
• /
• v.18A no.5
• /
• pp.177-180
• /
• 2011

In this paper, we present a record-replay technique based on interrupt logging and reproduction. Race conditions have been considered as the main source of nondeterminism in conventional record-replay approaches. However, interrupts are another source of nondeterministic computer system behavior, which must be reproduced at accurate time points, let alone the order of interrupt occurrence. We show that an interrupt-based replayer can be efficiently and effectively implemented by using hardware performance counters and debugging functionality. Experiments also show that the runtime overhead of the interrupt-based replayer is sufficiently low.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.21 no.3
• /
• pp.143-154
• /
• 2011

SQLite is a small sized database engine largely used in embedded devices and local application software. The availability of portable devices, such as smartphones, has been extended over the recent years and has contributed to growing adaptation of SQLite. This implies a high likelihood of digital evidences acquired during forensic investigations to include SQLite database files. Where intentional deletion of sensitive data can be made by a suspect, forensic investigators need to recover deleted records in SQLite at the best possible. This study analyzes data management rules used by SQLite and the structure of deleted data in the system, and in turn suggests a recovery Tool of deleted data. Further, the study examines major SQLite suited software as it validates feasible possibility of deleted data recovery.

• KIPS Transactions on Computer and Communication Systems
• /
• v.6 no.2
• /
• pp.59-66
• /
• 2017

MySQL database is the second place in the market share of the current database. Especially InnoDB storage engine has been used in the default storage engine from the version of MySQL5.5. And many companies are using the MySQL database with InnoDB storage engine. Study on the structural features and the log of the InnoDB storage engine in the field of digital forensics has been steadily underway, but for how to restore on a record-by-record basis for the deleted data, has not been studied. In the process of digital forensic investigation, database administrators damaged evidence for the purpose of destruction of evidence. For this reason, it is important in the process of forensic investigation to recover deleted record in database. In this paper, We proposed the method of recovering deleted data on a record-by-record in database by analyzing the structure of MySQL InnoDB storage engine. And we prove this method by tools. This method can be prevented by database anti forensic, and used to recover deleted data when incident which is related with MySQL InnoDB database is occurred.

• Journal of the Institute of Electronics and Information Engineers
• /
• v.49 no.9
• /
• pp.205-214
• /
• 2012

The main thing that IT operation managers consider is protecting assets of corporation from system failure and disaster. Therefore, this research proposed a backup system for a disaster recovery. Previous backup method is that if database update occurs, this record is saved in redo log, and if the size of record file is over than expected, this file is saved in archive log in order. Thus, it is possible to occur errors of data loss from the process of data backup which change in real time while changes of database occur. Suggested backup system is back redo log up to database of transaction log in real time, and back a record that can be omitted from previous backup method up to archive log. When recover the data, it is possible to recover redo log in real time online, and it minimizes data loss. Also, throughout multi thread processing method data recovery is performed and it is designed that system performance is improved. To verify stability of backup system CPN(Coloured Petri Net) is introduced, and each step of backup system is displayed in diagram form, and th e stability is verified based on the definition and theorem of CPN.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.26 no.2
• /
• pp.387-396
• /
• 2016

As the number of people using digital devices has increased, the digital forensic, which aims at finding clues for crimes in digital data, has been developed and become more important especially in court. Together with the development of the digital forensic, the anti-forensic which aims at thwarting the digital forensic has also been developed. As an example, with anti-forensic technology the criminal would delete an digital evidence without which the investigator would be hard to find any clue for crimes. In such a case, recovery techniques on deleted or damaged information will be very important in the field of digital forensic. Until now, even though EVTX(event log)-based recovery techniques on deleted files have been presented, but there has been no study to retrieve event log data itself, In this paper, we propose some recovery algorithms on deleted or damaged event log file and show that our recovery algorithms have high success rate through experiments.

• Journal of Korean Physical Therapy Science
• /
• v.4 no.1
• /
• pp.229-242
• /
• 1997

This study was performed to figure out effects of stroke rehabilitation on education using isokinetic exercise on physical function recovery. It is considered isokinetic exercise will playa primary role in muscle strength, ROM of joint, and body balance recovery for stroke rehabilitation and so far can be used as a basic references to increase the health of all people. The study consisted of 42 stroke patient(21 training group, 21 control group) diagnosed as cerebral hemorrhage from Oriental Rehabilitation Department of Kyung Hee University. Upper extremity and lower extremity exercise was performed in the training group using isokinetic ergometer. The recovery of physical function(muscle strength, ROM of joint, body balance) data between the two groups were compared and ana lysed by paired t-test are as followed. 1. Muscle testing record showed increased in the strength of elbow flexion, knee flexion, knee extension, ankle extension of the training group com paired to control group(p < .05). In the measurement of ROM, however other parts of the body motion showed no significant changes, only shoulder extension of the training group was increased(p < .05). 2. Body balance increase was highly significant in all training group compaired to control group(p<001). Based on these findings, stroke rehabilitation education with isokinetic ergometer showed available effects on recovery of physical function rehabilitation program with isokinetic exercise will play a primary role in the recovery of physical function of stroke or brain injury patients as well as to promote the health of all people.

• Annual Conference of KIPS
• /
• 2018.05a
• /
• pp.289-292
• /
• 2018

데이터베이스는 대용량의 데이터를 효율적으로 관리할 수 있는 장점을 가지고 있기 때문에 다양한 분야에서 사용되고 있다. 관련 범죄 발생 시 PC, 스마트폰 등 다지털 기기의 정보를 수집, 복구, 분석해 활용하는 '디지털포렌식'을 이용하여 수사가 진행된다. 이 때 삭제된 데이터의 복구가 중요하며 관련 연구가 많이 진행되고 있지만 삭제 방법보다 복구 방안에 초점을 두고 진행하는 경우가 많다. 따라서 본 논문에서는 실제 수사에서 데이터 복구 실패한 사례를 통해 기존 연구된 삭제된 레코드 복구 기법 방식을 실험한다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.25 no.5
• /
• pp.1143-1151
• /
• 2015

Extensible Storage Engine (ESE) database is a database developed by Microsoft. This database is used in web browser like Internet Explorer, Spartan and in Windows system with Windows Search, System Resource Usage Monitor. Previous ESE database viewer can display an incorrect result and can't read the file depending on collected environment and status of files. And the deleted record recovery tool is limited to some program and cannot recover all tables. This paper suggests the universal recovery method for deleted records and presents the experimental results through development of tool.

• Journal of Korean Academy of Nursing Administration
• /
• v.12 no.1
• /
• pp.63-75
• /
• 2006

Purpose: This study was aimed to specify roles of nurses from the anesthesia and recovery room by analyzing nursing activities as well as anesthesia nursing during surgery. Method: The objects were 12 RNs working in the recovery room of a university hospital located in Incheon. Self-report was performed by measuring stop-watch for five days from May 17th to May 21st in 2004. Research method was designed to record the time and frequency of the nursing activity from anesthesia and recovery room based on nurses' statement and other references for five days. The data were analyzed with descriptive statistics, ANOVA, and t-test via SPSS Win 10.0 program. Result: Nursing activities in anesthesia recovery room were classified into two different characteristics such as direct and indirect nursing activity. The activities consisted of 11 direct nursing areas and 39 nursing activities in anesthesia preparation room. The indirect nursing was classified into 8 nursing areas and 32 nursing activities. The direct nursing was classified into 12 nursing areas and 55 nursing activity. Also, the indirect nursing was classified into 7 nursing areas and 21 nursing activities in recovery room. In terms of prevalence of nursing activities in the anesthesia preparation room, observation and cooperation of anesthesia was the most prevalent activity, drug and eqipment management the second prevalent, and drug administration the third. On the other hand, in the recovery room, the most prevalent activity was vital sign checking and observation, the second most prevalent activity informative activity, and the third body temperature control. Nursing activity time was recorded according to the nursing characteristics. In the anesthesia preparation room, the direct nursing spent for 8092.20 minutes was larger than the indirect nursing spent for 7198.50 minutes. Also, in the recovery room, the direct nursing spent for 2361.16 minutes was larger than the indirect nursing spent for 1134.13 minutes. 4. Nursing activity time was compared to duty shifts. In the anesthesia preparation room, the direct nursing was more prevalent on day shift and the indirect nursing was prevalent on evening shift. However, in the recovery room, both direct and indirect nursing activities were prevalent on day shift. Conclusion: The role of anesthesia and recovery room nurses was analysed according to the time, frequency, and its characteristics.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.28 no.3
• /
• pp.625-633
• /
• 2018

Realm is an open source database developed to replace SQLite, which is commonly used in mobile devices. The data stored in the database must be checked during the digital forensic analysis process for mobile devices because it can help to understand the behavior of the user and whether the mobile device is operating or not. In addition, since the user can intentionally use anti-forensic techniques such as deleting data stored in the database, research on how to recover deleted records is needed. In this paper, we propose a method to recover records that have not been overwritten after deletion based on the analysis of the structure and record and deletion process of the Realm database file.