타임스탬프 변화패턴을 근거로 한 평가함수에 의한 디지털 포렌식 방법
A Digital Forensic Method by an Evaluation Function Based on Timestamp Changing Patterns
0
조회
0
다운로드
5
인용
0
참고문헌
키워드
초록
This paper proposes a digital forensic method by an evaluation function based ontimestamp changing patterns. Operations on file or folder leave changed timestamps, whichgive the ways to know what operations were executed. Changes of timestamps of tenoperations of a file and eight operations of a folder were examined. Analyses on the changeson the eight folder operations are newly added in this paper, which are not performed in theprevious works. Based on the timestamps changes of the file and the folder, two evaluationfunctions are proposed. The first evaluation function checks whether timestamps are changedby file and folder operations, and the second evaluation function checks whether timestampsare originated from a source file or other attribute field. By the two output values from theseevaluation functions, a digital forensic investigation on the file or the folder is performed. With some cases, i. e. file copy and folder creation operations, the proposed forensic methodis tested for its usefulness.
Abstract
This paper proposes a digital forensic method by an evaluation function based ontimestamp changing patterns. Operations on file or folder leave changed timestamps, whichgive the ways to know what operations were executed. Changes of timestamps of tenoperations of a file and eight operations of a folder were examined. Analyses on the changeson the eight folder operations are newly added in this paper, which are not performed in theprevious works. Based on the timestamps changes of the file and the folder, two evaluationfunctions are proposed. The first evaluation function checks whether timestamps are changedby file and folder operations, and the second evaluation function checks whether timestampsare originated from a source file or other attribute field. By the two output values from theseevaluation functions, a digital forensic investigation on the file or the folder is performed. With some cases, i. e. file copy and folder creation operations, the proposed forensic methodis tested for its usefulness.
참고문헌 (13)
- "MAC times"[URL]
- "Filesystem/NTFS File Attribute"[URL]
- B. Carrier, "File System Forensic Analysis", pp.340~341 (2005), Addison- Wesley
- E. Casey, "Uncertainty and Loss in Digital Evidence", International Journal of Digital Evidence, 1(2) (2002)
- K. P. Chow, "The Rules of Time on NTFS File System", SADFE ‘07, pp.71~85 (2007)
- S. Willasen, "Hypothesis-based Investigation of Digital Timestamps", IFIP Internation Federation for Information Processing, Vol. 285; Advances in Digital Forensics IV, pp.75~86 (2008)
- Gyu-Sang Cho, "A computer forensic method for detecting timestamp forgery in NTFS", COMPUTERS & SECURITY, 34, pp.36~46 (2013), ELSEVIER ADVANCED TECHNOLOGY
- Gyu-Sang Cho, "An Intuitive Computer Forensic Method by Timestamp Changing Patterns", Proceedings of IMIS 2014 (2014)
- C. Boyd, "Time and Date Issues in Forensic Computing - A Case Study", Digital Investigation, 1(1), pp.18~23 (2004)
- M. W. Stevens, "Unification of relative time frames for digital forensics", Digital Investigation, pp.225~239 (2004)
- 조규상, "컴퓨터 포렌식을 위한 NTFS 저널 파일의 분석", 디지털 포렌식 연구, 3(1), pp.51~60 (2009)
- 김태한, "NTFS 파일 시스템의 저널 파일을 이용한 파일 생성에 대한 디지털 포렌식 방법", (사)디지털산업정보학회 논문지, 6(2), pp.107~118 (2010), (사)디지털산업정보학회
- Gyu-Sang Cho, "Finding Forensic Information on Creating a Folder in $LogFile of NTFS", LNICST-ICDF2C 2011 proceedings, 3 (2012)