[논문]디지털 수사 초동조치 대응인력 및 예비분석관들이 갖추어야 할 요건

조슈아 제임스; 장윤식

doi:10.7236/jiibc.2016.16.5.49

초록
AI-Helper

디지털 증거를 다루는 범죄 사건 수사가 증가함에 따라 초동조치를 할 수 있는 인력과 개선된 수사절차 모델의 필요성이 증가하고 있다. 최근 들어 디지털 포렌식 분류(triage)와 예비분석 등의 개념이 수사 연구기관에 각광을 받고 있다. 하지만 초동조치 대응인력 및 예비분석관들이 구체적으로 어떤 훈련을 받아야 하는지에 대한 연구는 그다지 주목받지 못했다. 오히려 많은 조직에서 초동조치 대응인력이 전문적인 디지털 포렌식 분석관과 같은 실력을 갖추어야 한다고 여기고 있다. 본 연구에서는 '이상적인' 상황에서 디지털 수사의 초동조치 대응인력과 예비분석관들이 어떤 능력을 갖추어야 하며, 하드웨어 및 소프트웨어 측면에서의 필요사항과, 어쩌면 가장 중요하다 할 수 있는 교육훈련 조건에 대해 논하고자 한다.

Abstract ▼ AI-Helper

As investigations dealing with digital evidence increase, so to does the need for skilled first responders and improved investigation process models. Recently the concept of digital forensic triage and preliminary analysis has been gaining popularity in investigation laboratories. At the same time, ...

As investigations dealing with digital evidence increase, so to does the need for skilled first responders and improved investigation process models. Recently the concept of digital forensic triage and preliminary analysis has been gaining popularity in investigation laboratories. At the same time, however, there has been little focus on specific training needs of first response and preliminary analysts. Instead, many organizations consider these responders to need the same skills as full digital forensic analysts. In this work we describe the 'ideal' digital investigation first responder and preliminary analyst, hardware and software requirements and most importantly, required training.

주제어

AI 본문요약
AI-Helper

* AI 자동 식별 결과로 적합하지 않은 문장이 있을 수 있으니, 이용에 유의하시기 바랍니다.

문제 정의

This lecture discusses the operation of news groups and how illicit material can be distributed via this technology. Other topics include an introduction to social networking sites and the issues around privacy and harassment, and the reliability of user generated content.
This lecture serves as a basic introduction to the processes of forensic computing. Topics include the purposes of analyzing images of storage devices, chain of custody concerns and the hashing algorithms used to verify the integrity of evidence.
At the end of this lecture, participants will be able to summarize the operation of e-mail and effectively analyze the meta-data contained within e-mail headers, for the purposes of tracing their origin. This lecture will also discuss the issues regarding traceability and anonymity.
This lecture will discuss the components of modern computers, auxiliary storage solutions and provide a brief introduction to local networks.
This work contributes to the field of digital forensic investigation by providing one of the first comprehensive training plans for a triage or preliminary analyst in a digital forensic investigation laboratory.
. This work will not discuss the costs of such hardware and software, but instead make minimal and ideal hardware and software recommendations.

제안 방법

Currently investigation processes are the focus, but first responder and preliminary analyst training is also necessary. As investigations dealing with digital evidence increase, so to does the need for skilled first responders and improved investigation process models. In this work we described the 'ideal' digital investigation first responder and preliminary analyst, hardware and software requirements and most importantly, required training.
At the end of this lecture, participants will be able to explain the principles of electronic evidence seizure and demonstrate how to identify, seize and transport electronic evidence.
At the end of this lecture, participants will be able to summarize the operation of e-mail and effectively analyze the meta-data contained within e-mail headers, for the purposes of tracing their origin. This lecture will also discuss the issues regarding traceability and anonymity.
In [2], digital forensic investigators were surveyed on their investigation process. It was found (Fig. 1) that investigators naturally go through an exhibit sorting phase to determine the most likely sources of evidence (triage), the conduct a preliminary analysis to quickly gain more information about exhibits. From this preliminary analysis social and situational analyses will take place to determine if the exhibit should be sent for a further, time consuming full analysis.
Prior works have discussed the potential for triage and preliminary analysis, but have neglected a description of required training for such analysts. This work discusses the necessary prerequisites for candidates to the position of preliminary analyst and first responder (aka Triage Personnel) that will be assigned to Computer Forensic Triage Units. Section two covers the minimal and ideal prerequisites of the candidates.

후속연구

1. Observed high-level investigation process of child exploitation material when deciding to continue investigation of a suspect exhibit, where the first three phases - and sometimes a situational analysis - are used to make a decision to continue with a full analysis.

참고문헌 (10)

E. Casey, M. Ferraro, and L. Nguyen, "Investigation Delayed Is Justice Denied: Proposals for Expediting Forensic Examinations of Digital Evidence*," J. Forensic Sci., vol. 54, no. 6, pp. 1353-1364, Nov. 2009.

상세보기
J. I. James and P. Gladyshev, "A survey of digital forensic investigator decision processes and measurement of decisions based on enhanced preview," Digit. Investig., vol. 10, no. 2, pp. 148-157, Sep. 2013.

상세보기
G. Palmer, "A Road Map for Digital Forensic Research," Utica, New York, Nov. 2001.
M. B. Koopmans and J. I. James, "Automated network triage," Digit. Investig., vol. 10, no. 2, pp. 129-137, Sep. 2013.

상세보기
A. Shaw and A. Browne, "A practical and robust approach to coping with large volumes of data submitted for digital forensic examination," Digit. Investig., vol. 10, no. 2, pp. 116-128, Sep. 2013.

상세보기
A. Shaw and A. Browne, "A practical and robust approach to coping with large volumes of data submitted for digital forensic examination," Digit. Investig., vol. 10, no. 2, pp. 116-128, Sep. 2013.

상세보기
N. Jones, "Training and accreditation - who are the experts?," Digit. Investig., vol. 1, no. 3, pp. 189-194, Sep. 2004.

상세보기
R. Jones, "Your day in court - the role of the expert witness," Digit. Investig., vol. 1, no. 4, pp. 273-278, Dec. 2004.

상세보기
J. I. James and Y. Jang, "Practical and Legal Challenges of Cloud Investigations," The Journal of the Institute of Webcasting, Internet and Telecommunication, vol. 14, no. 6, pp. 33-39, Dec. 2014.
ACPO E-Crime Working Group, "Good Practice Guide for Computer-Based Electronic Evidence," 7safe Inf. Secur. website,[URL] http//7safe.com/electronic_evidence/index. html, 1996.

내보내기 구분	파일저장 인쇄 메일전송
구성항목	기본정보 상세정보 관리번호, 논문명, 저널/프로시딩명, 저자 , 발행년, 권, 호, 시작페이지, 끝페이지, 발행기관 관리번호, 논문명, 대등논문명, 저자 , 저널/프로시딩명, 발행기관, 발행년, 발행언어, 권, 호, 시작페이지, 끝페이지, ISBN, ISSN, 주제분야, 키워드, 초록(한글), 초록(영문), 저자(소속기관)
저장형식	Text(ASCII format) Excel format RefWorks Direct Export RIS format (for Reference Manager, ProCite, EndNote), Scholar's Aids, Mendeley
메일정보	받는사람 (필수) @ 보내는사람 (선택) @ 제목 내용 KISTI 검색결과 이메일 서비스
안내	총 건의 자료가 검색되었습니다. 다운받으실 자료의 인덱스를 입력하세요. (1-10,000) 검색결과의 순서대로 최대 10,000건 까지 다운로드가 가능합니다. 데이타가 많을 경우 속도가 느려질 수 있습니다.(최대 2~3분 소요) 다운로드 파일은 UTF-8 형태로 저장됩니다. 파일의 내용이 제대로 보이지 않을실 때는 웹브라우저 상단의 보기 -> 인코딩 -> 자동선택 여부를 확인하십시오. ~ Text(ASCII format) Excel format

연합인증

디지털 수사 초동조치 대응인력 및 예비분석관들이 갖추어야 할 요건
Digital Investigation First Responder and Preliminary Analyst Requirements 원문보기

초록
AI-Helper

Abstract ▼ AI-Helper

주제어

AI 본문요약
AI-Helper

문제 정의

제안 방법

후속연구

참고문헌 (10)

이 논문을 인용한 문헌

저자의 다른 논문 :

관련 콘텐츠

원문 보기

원문 URL 링크

오픈액세스(OA) 유형

이 논문과 함께 이용한 콘텐츠

AI-Helper ※ AI-Helper는 오픈소스 모델을 사용합니다.

선택된 텍스트

연합인증

디지털 수사 초동조치 대응인력 및 예비분석관들이 갖추어야 할 요건 Digital Investigation First Responder and Preliminary Analyst Requirements 원문보기

초록 용어보기논문에서 용어와 풀이말을 자동 추출한 결과로, 시범 서비스 중입니다. AI-Helper

Abstract ▼ AI-Helper

주제어

AI 본문요약 엑셀 다운로드 AI-Helper

문제 정의

제안 방법

후속연구

참고문헌 (10)

이 논문을 인용한 문헌

저자의 다른 논문 :

조슈아 제임스 (1) 장윤식 (2)

관련 콘텐츠

원문 보기

원문 URL 링크

오픈액세스(OA) 유형

이 논문과 함께 이용한 콘텐츠

AI-Helper ※ AI-Helper는 오픈소스 모델을 사용합니다.

선택된 텍스트

디지털 수사 초동조치 대응인력 및 예비분석관들이 갖추어야 할 요건
Digital Investigation First Responder and Preliminary Analyst Requirements 원문보기

초록
AI-Helper

AI 본문요약
AI-Helper