디지털 증거의 선별적 압수수색에 관한 LSH(Locality Sensitive Hashing)기법 활용방안 연구

Abstract

Currently, the selective search and seizure on electronic information allow the selective search and seizure in principle as far as electronic information in information storage devices is related to some incidents, but technically limitations exist. In order to find out the relevance of the case, the method used by investigative agencies is to search based on keyword within electronic information. The method of keyword search mainly progresses in the way of “Boolean search”, which has a characteristic that abstracts the result at the time of perfect match to the keyword combination. Recently, to avoid such methods of search and seizure by investigative agencies, we can see some cases that investigators attempt various methods of avoiding investigation, such as changing keyword related to the facts of suspicion and designating unrelated file names. Also, due to technological advances, the capacity of information storage devices and the number of electronic information are becoming larger and larger than ever before, and the rate of increase is rising exponentially. The method of Electronic information search and seizure should also be changed through the development of various technologies, since the capacity of the information storage devices to be explored for electronic information is expected to become larger in the future. In this paper, I propose a method of selective search and seizure of digital evidence using a kind of text mining, Locality Sensitive Hashing. The method I would suggest is to calculate additional words and sentences throughout the document from the existing keyword search method and quickly compare and list the similarities of documents in the data storage devices. This method confirmed the four improvements. First, it is possible to detect electronic information related to the suspected facts that could not be verified by the existing methods. Second, adding the existing selective search and seizure method will speed up the overall search for information storage devices. Third, it brings diversity in methods of selective search and seizure for electronic information. Finally, document similarity is better at protecting the privacy of the oppressed than keyword search. I believe that if I introduce a variety of text mining techniques into electronic information search and seizure methods, starting with document similarity, I can gradually develop into a screening confiscation method that will give us a variety of possibilities to discover the actual truth.