디지털 증거 수집에 대하여

소개글

대학원 레포트 입니다

목차

1. 서문······································································································································· 3

1.1 디지털 증거(Digital Evidence) 정의 ······································································· 3

1.2 디지털 증거 종류 ································································································ 3
1.2.1 디지털 증거의 속성에 따른 분류 ·························································· 3
1.2.2 디지털 증거의 생성 방식에 따른 분류 ························································· 3
1.2.3 디지털 증거의 휘발성에 따른 분류 ································································ 3

1.3 기존 증거와 디지털 증거의 차이 ····································································· 3

1.4 디지털 증거의 특수성 ······························································································ 3


2. 디지털 증거 수집 절차 ···························································································· 5

2.1. 디지털 증거 준비 단계 ······················································································· 5
2.1.1 디지털 증거물 수집 계획의 수립 ···································································· 5
2.1.2 디지털 증거 수집팀 구성 ······································································· 5

2.2. 디지털 증거 수집 단계 ··········································································································· 7

2.3. 디지털 증거 이송, 보관 단계 ··································································································· 8


3. 디지털 증거 분석 ······································································································· 8

3.1. 디지털 증거 분석의 개념과 특성 ··································································································· 9

3.2. 디지털 증거 분석 절차 ················································································· 9

3.3. 디지털 증거 분석 도구 ·················································································································· 14

3.4. 디지털 증거 분석 유의사항 ··············································································································· 17


<표 목 차>

<표 2-1> 증거 수집 및 분석을 위한 추가장비 ············································································ 6

<표 2-2> 현장 증거 분석에 필요한 케이블 및 어댑터 ····························································· 7



<그 림 목 차>


<그림 1> 하드 디스크의 구조 ······················································································································ 9

<그림 2> 하드 디스크 복구를 위한 Clean Room(명정보기술) ······················································ 10

<그림 3> 이미지 파일을 브라우징 한 예(EnCase) ············································································ 10

<그림 4> 해쉬 검색의 흐름 ······················································································································ 11

<그림 5> 전문 검색 프로그램인 dtSearch ··················································································· 12

<그림 6> NTFS의 사용법과 sfind를 사용한 탐지법 ····································································· 13

<그림 7> Guidance Software社의 EnCase프로그램 ····································································· 14

<그림 8> 파일 복구 프로그램(Final Data) ·························································································· 15

<그림 9> Elcomsoft社의 Advanced Office Password Recovery ··················································· 15

<그림 10> AccessData社의 Registry Viewer 프로그램 ······································································· 16

<그림 11> 실행파일 역공학 분석 도구 Olly Debugger ····························································· 17

본문내용

1. 서문

1.1 디지털 증거(Digital Evidence) 정의

컴퓨터 또는 기타 디지털 저장 매체에 저장되거나 네트워크를 통해 전송 중인 자료로서 법정에서 신뢰할 수 있으며 증거 가치가 있는 정보이다.
IOCE(International Organization on Computer Evidence)는 이진수 형태로 저장 혹은 전송되는 것으로 법정에서 신뢰할 수 있는 정보라고 디지털 증거를 정의하고 있으며, http://www.ioce.org
미국 SWGDE(Scientific Working Group on Digital Evidence)에서는 디지털 형태로 저장되거나 전송되는 증거가치가 있는 정보를 말한다. https://www.swgde.org


1.2 디지털 증거 종류
디지털 증거의 종류를 구분하는 방법에는 저장매체의종류, 증거의내용, 법적효력 또는 디지털정보의 휘발성정도, 디지털 증거의 진정성과 무결성을 만족시켜 주는 속성에 따라 구분하는 방법이 존재한다.

<중 략>

3.4. 디지털 증거 분석 유의사항

분석에 있어서는 아래와 같은 원칙을 준수한다. 분석과정이 명확해야 하고 분석자 성명, 분석일자, 방법 등 작업에 대한 기록을 반드시 유지하도록 해야 한다. 또 결과 도출과정을 재현할 수 있어야 하며 다른 사람이 분석할 경우에도 같은 결과가 나와야 한다. 그렇지 않다면 분석도구 및 방법의 신뢰성을 인정할 수 없기 때문이다.

분석 도중 결정적 증거물을 발견한 경우 반드시 그 증거가 위치하고 있는 논리적, 물리적 주소를 확보해야 한다. 그리고 분석과정에서 증거물이 훼손되지 않아야 하고 훼손되지 않았음을 증명할 수 있어야 한다. 분석 후 증거물에 대한 메시지 다이제스트 기법을 사용하는 등의 방법을 취할 수 있을 것이다.
또 삭제 유실 손상된 파일은 복원하고 암호화된 파일은 복호화하여 분석한다. 이 경우 디지털 증거파일이 필연적으로 변경되게 되므로 관계자 입회·문서화 등 사후 입증 절차를 갖추어야 한다. 분석내용은 기본적으로 행위자·시간·내용 등의 순서로 파악하고 가능하면 사건을 재현할 수 있도록 해야 한다.

참고 자료

없음