• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.25 no.5
• /
• pp.1143-1151
• /
• 2015

Extensible Storage Engine (ESE) database is a database developed by Microsoft. This database is used in web browser like Internet Explorer, Spartan and in Windows system with Windows Search, System Resource Usage Monitor. Previous ESE database viewer can display an incorrect result and can't read the file depending on collected environment and status of files. And the deleted record recovery tool is limited to some program and cannot recover all tables. This paper suggests the universal recovery method for deleted records and presents the experimental results through development of tool.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.30 no.4
• /
• pp.559-572
• /
• 2020

As internet technology advances, users can share content online, and many sharing services exist. According to a recently published digital forensic study, when playing an online streaming service, you can restore the played video by reconstructing the Chrome cache file left on local device such as a PC. This can be seen as evidence that the user watched illegal video content. From a different point of view, copyright infringement occurs when a malicious user restores video stream and share it to another site. In this paper, we selected 23 online streaming services that are widely used both at home and abroad. After streaming videos, we tested whether we can recover original video using cache files stored on the PC or not. As a result, the paper found that in most sites we can restore the original video by reconstructing cache files. Furthermore, this study also discussed methodologies for preventing copyright infringement in online streaming service.

• Journal of the Institute of Electronics Engineers of Korea CI
• /
• v.47 no.2
• /
• pp.29-38
• /
• 2010

Network Video Recorder becomes popular as a next generation surveillance system connecting all cameras and video server in network environment because it can provide ease of installation and efficient management and maintenance. But in case of data damage, the storage device in traditional NVR has no recovery scheme and it is disabled in processing real-time requests. In this paper, we propose an Reliable Storage using Parity and Mirroring scheme for improving reliability on storage device and maintaining system on realtime. RSPM uses a Liberation coding to recover damaged multimedia data and dynamic mirroring to repair corrupted system data and to maintain real-time operation. RSPM using the Liberation code is 11.29% lesser than traditional file system and 5.21% less than RSPM using parity code in terms of loss rate of damaged multimedia data.

• Journal of KIISE:Computer Systems and Theory
• /
• v.35 no.6
• /
• pp.248-262
• /
• 2008

As the number of large size multimedia files increases and the importance of individual's digital data grows, storage devices have been advanced to store more data into smaller spaces. In such circumstances, a physical damage in a storage device can destroy large amount of important data. Therefore, it is needed to verify the robustness of various physical faults in storage device before certain systems are used. We developed SOAR(Storage Reliability Analyzer), Storage Reliability Analyzer, to detect physical faults in diverse kinds of HDD hardware components and to recover the systems from those faults. This is a useful tool to verify robustness and reliability of a disk. SOAR uses three unique methods of creating physical damages on a disk and two unique techniques to apply the same feature on file systems. In this paper, we have performed comprehensive tests to verify the robustness and reliability of storage device with SOAR, and from the verification result we could confirm SOAR is a very efficient tool.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.30 no.3
• /
• pp.397-403
• /
• 2020

With the convenience of real-time conversation, multimedia file and contact sharing services, most people use instant messenger, and its usage time is increasing. Because the messengers contain a lot of user behavior information data, in the digital forensic investigation, they can be very useful evidence to identify user behavior. However, some of useful data can be difficult to acquire or recognize because they are encrypted or deleted. Thus, in order to use the messenger data as evidence, the study of message decryption process and message recovery is essential. In this paper, we analyze the database encryption process of the instant messenger, MalangMalang Talkafe, and propose the method to decrypt it. In addition, we propose the methods to identify the deleted messages and recover from the volatile memory area.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.22 no.1
• /
• pp.57-65
• /
• 2012

People leave voicemails or record phone conversations in their daily cell phone use. Sometimes important voice data is deleted by the user accidently, or purposely to cover up criminal activity. In these cases, deleted voice data must be able to be recovered for forensics, since the voice data can be used as evidence in a criminal case. Because cell phones store data that is easily fragmented in flash memory, voice data recovery is very difficult. However, if there are identifiable patterns for the deleted voice data, we can recover a significant amount of it by researching images of it. There are several types of voice data, such as QCP, AMR, MP4, etc.. This study researches the data recovery solutions for EVRC codec and AMR codec in QCP file, Qualcumm's voice data format in cell phone.

• Journal of Korea Society of Industrial Information Systems
• /
• v.27 no.2
• /
• pp.1-10
• /
• 2022

Deception technology is an extended concept of honeypot, which detects, prevents or delays attacks by deceiving adversaries. It has been applied to various system components such as network ports, services, processes, system calls and database management systems. We can apply the same concept to attacks on files. A representative example of a file attack is ransomware. Ransomware is a type of malware that encrypts user files and ask for ransom to recover those files. Another example is the wiper attack, which erases all or target files of a system. In this paper we propose a defense mechanism against these kinds of attacks by hiding files. Compared to backup or virtualization techniques, the proposed method incurs less space and performance overheads.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.33 no.4
• /
• pp.609-619
• /
• 2023

Recently, crimes using drones, one of the IoT industries have been continuously reported. In particular, drones are characterized by easy access and free movement, so they are used for various crimes such as transporting explosives, transporting drugs, and illegal recording. In order to analyze and investigate these criminal acts, drone forensic research is highly emphasized. Media data, PII, and flight records are digital forensic artifacts that can be acquired from drones, in particluar flight records are important artifacts since they can be used to trace drone activities. Therefore, in this paper, the characteristics of the deleted flight record files of DJI drones are presented and verified using the Phantom3, Phantom4 andMini2 models, two drones with differences in characteristics. Additionally, the recovery level is analyzed using the flight record file characteristics, and lastly, drones with the capacity to recover flight records for each drone model and drone models without it are classified.

• Journal of Internet Computing and Services
• /
• v.24 no.6
• /
• pp.137-144
• /
• 2023

Cyberattack technology is evolving to an unpredictable degree, and it is a situation that can happen 'at any time' rather than 'someday'. Infrastructure that is becoming hyper-connected and global due to cloud computing and the Internet of Things is an environment where cyberattacks can be more damaging than ever, and cyberattacks are still ongoing. Even if damage occurs due to external influences such as cyberattacks or natural disasters, intelligent self-recovery must evolve from a cyber resilience perspective to minimize downtime of cyber assets (OS, WEB, WAS, DB). In this paper, we propose an intelligent self-recovery technology to ensure sustainable cyber resilience when cyber assets fail to function properly due to a cyberattack. The original and updated history of cyber assets is managed in real-time using timeslot design and snapshot backup technology. It is necessary to secure technology that can automatically detect damage situations in conjunction with a commercialized file integrity monitoring program and minimize downtime of cyber assets by analyzing the correlation of backup data to damaged files on an intelligent basis to self-recover to an optimal state. In the future, we plan to research a pilot system that applies the unique functions of self-recovery technology and an operating model that can learn and analyze self-recovery strategies appropriate for cyber assets in damaged states.