정보기술아키텍쳐기반의디지털포렉식체제구현을 위한 연구

Abstract

There are many models for digital forensic procedure based on processes or architectures. Because of insufficiency of previous models, some practical examples show that they can not be covered by traditional explanations. One example is the brand new online evidence collecting system implemented by Korean Police, which enables the Internet users directly transfer their mobile phone video clips captured by themselves. No model found to explain this kind of digital evidence handling. I ascertained that it is because many models followed physical forensic system without concerning virtual nature and the development of digital forensic methodologies. To solve this problem, I proposed to adopt the concept of Enterprise Architecture(EA) into digital forensic system. Most of all, modern digital forensic system could not be mentioned without information system. Even though there could be many other consideration which should be taken into, information system is conducting main role in digital forensics and it is being extended day by day. Automated and network based forensics are typical examples which do need minimal role of human during collecting evidence. The second reason that requires implementation of EA is because we need broader architecture which can include more exemptions. The last but not least, recently proposed security architecture for enterprises is found to be more compatible with digital forensics. These two share many major concepts including not only security itself, but integrity and others as well. Designing enterprise level architecture is not easy work. Prior to propose concrete architecture model, I proposed several presumptions. These are standardization, considering legal aspects, compliance with the regimes which dominate current forensic system involving accreditation of crime labs, and dividing from ordinary information system architecture.