Full Disk Encryption 환경에서 디지털 증거 수집 절차에 관한 연구
The Research for Digital Evidence Acquisition Procedure within a Full Disk Encryption Environment
1
조회
0
다운로드
6
인용
0
참고문헌
키워드
초록
최근 개인정보보호에 관심이 증대되면서 암호화 솔루션 사용이 증가하고 있다. 또한, Windows XP 서비스 지원 종료와 함께 사용자의 운영체제 사양이 향상되면서, Bitlocker와 같은 Full Disk Encryption 솔루션의 활용도가 높아질 것으로 예상된다. 따라서 앞으로의 디지털 포렌식 조사는 Full Disk Encryption 환경에 대한 대응이 필요하다. 본 논문에서는 Full Disk Encryption 환경에 대응하는 디지털 증거 수집 절차를 제안하고 Full Disk Encryption솔루션 중 사용률이 높은 제품들의 대응 방법 및 탐지 도구를 소개한다.
Abstract
As a growing number of people are concerned about the protection of personal information, the use of encryption solutionhas been increased. In addition, with the end of support for Windows XP and the improvement of operating system, the use ofthe Full Disk Encryption solution like Bitlocker will be increased. Therefore, it is necessary to consider countermeasures againstFull Disk Encryption for the future digital forensic investigation. This paper provides the digital evidence acquisition procedurethat responds to the Full Disk Encryption environment and introduces the countermeasures and detection tool against Full DiskEncryption solutions that are widely used.
참고문헌 (17)
- "G2Crowd" (2014)[URL]
- E Casey, "The Impact of Full Disk Encryption on Digital Forensics", ACM SIGOPS Operating Systems Review, 42(3), pp.93~98 (2008)
- Sangjin Lee, "Introduction of Digital Forensics" (2011), Digital Forensic Research Center
- Ministry of Justice, "Criminal Procedu re Law-Code 106, Seizure", ~ (2014)
- Supreme Prosecutors‘ office, "Digital e vidence acquiring and analysis provisi ons", ~ (2012)
- "Microsft" (2007)[URL]
- Hargreaves, "Recovery of encryption keys from memory using a linear scan", Availability, Reliability and Security, 2008. ARES 08. Third International Conference on, pp.1369~1376 (2008)
- SANS, "Encrypted Storage Incident H andling" (2009), SANS
- "Magnet Forensics" (2013)[URL]
- "Forensic Wikipedia" (2014)[URL]
- "Microsoft" (2013)[URL]
- "Symantec" (2012)[URL]
- Liang, Min, "Research and design of full disk encryption based on virtual machine", Computer Science and Information Technology (ICCSIT), 2010 3rd IEEE International Conference on, 2, pp.642~646 (2010)
- Halderman, J. Alex, "Lest we remember:cold-boot attacks on encryption keys", Communications of the ACM, 52(5), pp.91~98 (2009)
- Balogh, Stefan, "Capturing encryption keys for digital analysis", Intelligent Data Acquisition and Advanced Computing Systems (IDAACS), 2011 IEEE 6th International Conference on, 2, pp.759~763 (2011)
- Dietiker, Kristen, "PGP whole disk en cryption: blazing trails in IT security at UW Medicine", Proceedings of the 36th annual ACM SIGUCCS fall conference:moving mountains, blazing trails, pp.17~20 (2008)
- Hargreaves, "Detecting hidden encrypted volumes", Communications and Multimedia Security, pp.233~244 (2010)