디지털 이미지 증거에서 사건과 무관한 파일 삭제시 무결성 제공 방안 연구
A Study on the Providing the Integrity of Digital Evidence while Deleting the irrelevant File
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
The digital forensic analysis ensures the integrity of confiscated data by calculating hash values for seizure and search of digital evidence and receiving confirmation and signature from participants. However, evidence that is irrelevant to the alleged offense needs to be deleted even after seizure from the point of view of privacy. But the hash value is altered by deleting the irrelevant data from the image file, one will not be able to prove that the file is in the initial state when it was seized. Therefore, in this paper, a study was conducted to support the integrity of the digital evidence, even if some of the seized digital evidence was deleted or damaged during the seizure search. The hash value of each data is calculated and hash value of the combination of hash values are also calculated. Even if the unrelated evidence is deleted from the seized evidence regardless of file system such as FAT or NTFS, the suggested method presented a way to provide the integrity that proves there is no change in the evidence file.
Abstract
The digital forensic analysis ensures the integrity of confiscated data by calculating hash values for seizure and search of digital evidence and receiving confirmation and signature from participants. However, evidence that is irrelevant to the alleged offense needs to be deleted even after seizure from the point of view of privacy. But the hash value is altered by deleting the irrelevant data from the image file, one will not be able to prove that the file is in the initial state when it was seized. Therefore, in this paper, a study was conducted to support the integrity of the digital evidence, even if some of the seized digital evidence was deleted or damaged during the seizure search. The hash value of each data is calculated and hash value of the combination of hash values are also calculated. Even if the unrelated evidence is deleted from the seized evidence regardless of file system such as FAT or NTFS, the suggested method presented a way to provide the integrity that proves there is no change in the evidence file.
참고문헌 (8)
- 이완규, "디지털 증거 압수 절차상 피압수자 참여 방식과 관련성 범위 밖의 별건 증거 압수 방법", 형사법의 신동향, (48), pp.90~158 (2015), 대검찰청[DOI]
- 정교일, "디지털 증거의 압수와 공판정에서의 제출방안", 형사법의 신동향, (25), pp.104~205 (2010), 대검찰청[DOI]
- 이인수, "디지털증거 확보체계", 정보보호학회지, 26(5) (2016)
- 김기범, "해시함수의 형사법적 고찰", 형사정책연구, 29(2), pp.199~226 (2018), 한국형사법무정책연구원
- 이상미, "관련성 없는 디지털증거 삭제시 이중해쉬를 이용한 무결성 입증 방안", 석사, pp.2016
- 박송이, "파티션 복구 도구 검증용 데이터 세트 개발 및 도구 평가", 정보보호학회논문지, 27(6), pp.1397~1404 (2017), 한국정보보호학회[DOI]
- "암호 알고리즘 및 키 길이 이용 안내서, KISA-GD-2018", 한국인터넷진흥원, ~ (2018)
- 이보만, "기업회계장부 압수수색과 DB파일 포렌식 기술 적용방법 연구", 한국컴퓨터정보학회 하계학술대회 논문집, 19(2) (2011)