디렉토리 인덱스 안티포렌식 기법에서 Windows 파일명에 사용할 수 없는 문자 문제의 해결방법
A Problem Solving Method for Non-Admittable Characters of a Windows File Name in a Directory Index Anti-Forensic Technique
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
This research proposes a modified data hiding method to hide data in a slack space of an NTFS index record. The existing data hiding method is for anti-forensics, which uses traces of file names of an index entry in an index record when files are deleted in a direcotry. The proposed method in this paper modifies the existing method to make non-admittable ASCII characters for a file name applicable. By improving the existing method, problems of a file creation error due to non-admittable characters are remedied; including the non-admittable 9 characters (i. e. slash /, colon :, greater than >, less than <, question mark ?, back slash \, vertical bar |, semi-colon ;, esterisk * ), reserved file names(i. e. CON, PRN, AUX, NUL, COM1~COM9, LPT1~LPT9) and two non-admittable characters for an ending character of the file name(i. e. space and dot). Two results of the two message with non-admittable ASCII characters by keyboard inputs show the applicability of the proposed method.
Abstract
This research proposes a modified data hiding method to hide data in a slack space of an NTFS index record. The existing data hiding method is for anti-forensics, which uses traces of file names of an index entry in an index record when files are deleted in a direcotry. The proposed method in this paper modifies the existing method to make non-admittable ASCII characters for a file name applicable. By improving the existing method, problems of a file creation error due to non-admittable characters are remedied; including the non-admittable 9 characters (i. e. slash /, colon :, greater than >, less than <, question mark ?, back slash \, vertical bar |, semi-colon ;, esterisk * ), reserved file names(i. e. CON, PRN, AUX, NUL, COM1~COM9, LPT1~LPT9) and two non-admittable characters for an ending character of the file name(i. e. space and dot). Two results of the two message with non-admittable ASCII characters by keyboard inputs show the applicability of the proposed method.
참고문헌 (12)
- "NTFS - Features - Scalability"[URL]
- "How NTFS Works"[URL]
- B. Carrier, "File System Forensic Analysis", pp.273~396 (2005), Addison-Wesley
- "NTFS INDX Attribute Parsing"[URL]
- "“NTFS $I30 Index Attributes: Evidence of Deleted and Overwritten Files,” SANS Digital Forensics and Incident Response Blog"[URL]
- "Incident Response with NTFS INDX Buffers - Parts 1, 2, 3 and 4"[URL]
- Ewa Huebner, "Data hiding in the NTFS file system", Digital Investigation, 3(4), pp.211~226 (2006)
- 조규상, "타임스탬프 변화패턴을 근거로 한 평가함수에 의한 디지털 포렌식 방법", (사)디지털산업정보학회 논문지, 10(2), pp.91~105 (2014), (사)디지털산업정보학회
- 조규상, "Windows 파일시스템의 디렉토리에 대한 디지털 포렌식 분석", (사)디지털산업정보학회 논문지, 11(2), pp.73~90 (2015), (사)디지털산업정보학회[DOI]
- Gyu-Sang Cho, "NTFS Directory Index Analysis for Computer Forensics", IMIS 2015(the 9-th Int. Conf. on Innovative Mobile and Internet Services in Ubiquitous Computing) (2015)
- 조규상, "새로운 NTFS 디렉토리 인덱스 안티포렌식 기법", 한국정보전자통신기술학회 논문지, 8(4), pp.327~337 (2015), 한국정보전자통신기술학회
- "Naming Files, Paths, and Namespaces"[URL]