• KIPS Transactions on Computer and Communication Systems
• /
• v.2 no.2
• /
• pp.93-102
• /
• 2013

These days digital data have become essential for digital investigation because most of the crime was occurred by using the digital devices. However, digital data is very easier to falsify or delete. If digital data was deleted, it is necessary to recover the deleted data for obtain digital evidence. Even though file carving is the most important thing to gather. digital evidence in digital forensic investigation, most of popular carving tools don't contemplate methods of selection or restoration for digital forensic investigation. The goal of this research is suggested files which can obtain useful information for digital forensic investigation and proposed new record file carving technique to be able to recover data effectively than before it.

• Journal of the Korea Society of Computer and Information
• /
• v.17 no.11
• /
• pp.101-105
• /
• 2012

Various social problems through violating personal information and privacy are growing with the rapid spread of smartphones. For this reason, variety of researches and technology developments to protect personal information being made. The smartphone, contains almost all of the personal information, can cause data spill at any time. Collecting or analyzing evidence is not an easy job with forensic analyzing tool. Android forensics research has been focused on techniques to collect and analyze data from non-volatile memory but research for volatile data is very slight. Android log is the non-volatile data that can be collected by volatile storage. It is enough to use as a material to track the usage of the Android phone because all of the recent driven records from system to application are stored. In this paper, we propose a method to respond to determining the existence of personal information leakage by filtering logs without forensic analysis tools.

• Journal of the Korea Society of Computer and Information
• /
• v.19 no.12
• /
• pp.161-169
• /
• 2014

Digital forensics is the process of proving criminal charges by collecting and analyzing digital evidence which is related to the crime in question. Most digital forensic research is focused on digital forensic techniques themselves or cyber crime. In this paper, we designed a digital forensics-criminal investigation linked model in order to effectively apply digital forensics to various types of criminal investigations. Digital forensic ontology was developed based on this model. For more effective application of digital forensics to criminal investigation we derived specific application fields. The ontology has legality rules and adequacy rules, so it can support investigative decision-making. The ontology can be developed into an intelligent criminal investigation system.

• Journal of Advanced Navigation Technology
• /
• v.18 no.1
• /
• pp.50-55
• /
• 2014

Recently, importance of digital forensics has increased and using analysis methods of digital evidence in the analysis of evidence of various types. However, analysis time and effort is steadily increasing because personal disk capacity is too big and it has many number of files. Most digital evidence has time property, such as access time, creation time, and modification time. These time information of digital evidence is one of most important factors in the digital forensic area. But if digital examiner simply analyze based on binary source only, it is possible to have wrong result because time has various types. In this paper, we classify various type of time in the digital evidence and describe advanced analysis method based on timeline chart for digital forensic investigation.

• Proceedings of the Korean Information Science Society Conference
• /
• 2008.06a
• /
• pp.29-30
• /
• 2008

• Journal of Information Processing Systems
• /
• v.11 no.1
• /
• pp.104-115
• /
• 2015

Along with the evolution of Internet and its new emerging services, the quantity and impact of attacks have been continuously increasing. Currently, the technical capability to attack has tended to decrease. On the contrary, performances of hacking tools are evolving, growing, simple, comprehensive, and accessible to the public. In this work, network penetration testing and auditing of the Redhat operating system (OS) are highlighted as one of the most popular OS for Internet applications. Some types of attacks are from a different side and new attack method have been attempted, such as: scanning for reconnaissance, guessing the password, gaining privileged access, and flooding the victim machine to decrease availability. Some analyses in network auditing and forensic from victim server are also presented in this paper. Our proposed system aims confirmed as hackable or not and we expect for it to be used as a reference for practitioners to protect their systems from cyber-attacks.

• Journal of Korea Multimedia Society
• /
• v.20 no.1
• /
• pp.66-73
• /
• 2017

Due to the recent rapid changes in society and wide spread of information devices, diverse digital information is utilized in a variety of economic and social analysis. Information related to the crime statistics by type of crime has been used as a major factor in crime. However, statistical analysis using only the structured data has the difficulty in the investigation by providing limited information to investigators and users. In this paper, structured data and unstructured data are analyzed by applying Korean Natural Language Processing (Ko-NLP) and the Latent Semantic Analysis (LSA) technique. It will provide a crime profile optimum system that can be applied to the crime profiling system or statistical analysis.

• Proceedings of the Korean Society of Computer Information Conference
• /
• 2011.06a
• /
• pp.149-153
• /
• 2011

2010년에는 국내에 Smart Phone이 확산되면서, Smart Phone은 단순한 음성통신정보 전달 이외에 기존의 인터넷 PC가 정보를 전달 할 수 있는 전자책, 영화, 음악, 콘텐츠 영역으로 확장되고 있다. 하지만 Smart Phone 사용자들은 멀티미디어 저작권 콘텐츠를 불법으로 이용하고 있다. 또한 이동통신 단말로서 Smart Phone관련 범죄 증거의 생성, 저장된 디지털 증거는 증거의 활용도가 높아 모바일 포렌식 연구가 필요하다. 본 논문에서 Smart Phone에서 저작권 위반 내용들을 전자책, 영화, 음악, 콘텐츠 영역으로 조사한다. 저작권 위반 Smart Phone 증거자료를 추출하고 분석하기 위한 SYN 방식과 JTAG 방식을 연구한다. Smart Phone SYN 방식과 JTAG 방식으로 Smart Phone의 저작권 위반 자료를 추출하여 복원하고, 자료를 분석하였다. 본 연구 결과는 저작권위반 단속 기술 향상과 포렌식 수사 기술 발전에 기여 할 수 있을 것이다.

• Proceedings of the Korean Society of Computer Information Conference
• /
• 2011.06a
• /
• pp.207-211
• /
• 2011

기업들의 비자금 수사를 받기 전에 압수수색 대상 회계 파일의 삭제, 파손 및 은닉하고 있다. 2010년 H 그룹 비자금 조성 사건에서도 삭제된 파일에서 회계처리, 비자금 문제를 발견하였다. 최근에는 Smart Phone의 활성화와 함께 주요 증거물을 Smart Phone에 저장하고 업무를 진행하고 있다. 본 논문에서는 압수수색된 Smart Phone에서 기업의 회계장부를 찾아내고, 삭제한 회계장부를 복원하는 포렌식 수사기술에 관한 연구이다. 기업에 대한 압수수색 준비와 압수 수색, 획득 증거 분석 등의 절차와 포렌식 도구들을 분석한다. Smart Phone 압수수색 후 포렌식 증거 자료 추출 과정과 포렌식 도구를 이용하여 실험하고 포렌식 증거자료를 추출한다. 본 논문을 통해서 Smart Phone 포렌식 기술발전에 기여 하고자 한다.

• Proceedings of the Korean Society of Computer Information Conference
• /
• 2011.06a
• /
• pp.185-189
• /
• 2011

GM대우차와 쌍용차에 관한 기술 유출 사고에서의 국가 경제적인 피해로 인하여 e-Discovery 제도 도입과 연구가 필요하다. 본 논문에서는 e-Discovery에 개념과 관련법안 및 권고안, 포렌식 수사절차에 대해 연구하고, 한국의 e-Discovery 사고 사례를 연구하고, e-Discovery가 도입되면 포렌식 자료를 위한 보안관제시스템에서의 인증과 암호화를 연구하였다. 보안관제시스템의 접근과 인증을 위한 사용자인증과 기기인증에 대한 기술과 암호화 기술을 연구하였다. 본 논문 연구를 통하여 e-Discovery 제도의 도입과 포렌식 기술 발전에 기초자료로 활용될 것이다.