KR20230112310A - System of forensic for selectively extracting and analyzing of target data by remote networking. - Google Patents

Abstract

The present invention relates to a forensic system capable of selectively extracting and analyzing target data through remote networking, comprising: a data management unit that is networked remotely connected to an original repository, selects target data from the original repository, and selectively analyzes it to produce analysis data; a user terminal unit having an original storage, remotely networked with the data management unit, and remotely and selectively extracting target data; and a monitoring unit that is connected to the data management unit via networking, receives analysis data, and selectively monitors the monitoring unit.

Description

System of forensic for selectively extracting and analyzing of target data by remote networking.}

The present invention relates to a forensic system capable of selectively extracting and analyzing target data through remote networking. More specifically, it is a technical field related to a system for analyzing and monitoring target data by being networked remotely to select target data from an original storage.

BACKGROUND OF THE INVENTION [0002] As the information society is advanced due to the development of IT technology, the use of electronic documents using smartphones, tablets, PCs, etc. is increasing.

Electronic documents created through a computer are very easy to copy and modify, and deleting a large amount of records can be solved with a single mouse click. In addition, when a file is copied from a computer to another location, the electronic document has a characteristic in that the copy file and the original file appear to be the same file with no difference in content.

However, as the technology of electronic documents has advanced, related crimes have increased, and as the case of storing important clues in digital information devices including computers also increases in general crimes, professional digital forensic technology for collecting and analyzing evidence is required.

Digital forensic is a new security service field that identifies and proves the factual relationship of an action that has occurred through the medium of the information device based on the digital data embedded in the information device.

Digital forensic is very useful for criminal investigations, civil disputes, and infringement accidents. Recently, the trend of being introduced into activities for auditing information within companies and preventing leakage of industrial technology is spreading. In order to prevent the leakage of industrial technology, the introduction of technology related to digital forensics within the company is recommended as a way to keep track of digital evidence. For example, forensic technology can be used to strengthen internal security, such as collecting legal evidence for insurance fraud and Internet banking damage compensation, preventing leakage of internal information, and auditing.

Digital forensics usually follows procedures such as acquisition of evidence, storage and transfer, analysis and investigation, and report writing. Evidence acquisition is the process of collecting digital evidence at the scene of an incident. Storage and transfer is a step in which the evidence is transferred to the analysis room and images of the digital evidence are created, and it is a preparation procedure for analysis and investigation. Analysis and investigation recovers data used as evidence and analyzes digital data using various forensic analysis techniques such as file search, decryption, hash analysis, and signature analysis. Finally, in the report preparation process, the results of the analysis and investigation are explained in an easy-to-understand manner to the general public from the standpoint of experts in digital evidence, and submitted to the court.

In addition, in order for digital records to be used as evidence, various methods are used to prove that the evidence has not been tampered with with various devices to eliminate the possibility of forgery and falsification in the entire digital forensic process, such as the acquisition and analysis processes.

As an example of related prior patent documents, "Digital Evidence Analysis System and Method" (Registration No. 10-1288034, hereinafter referred to as Patent Document 1)" exists.

In the invention according to Patent Document 1, the digital evidence analysis system includes a first network for performing user authentication on a user terminal connected to a business management system, a second network for allowing user terminals connected to the analysis network to access the digital evidence analysis system for analysis of digital evidence files obtained during digital forensics, and a third network for individually allocating VLAN (Virtual LAN) IDs to user terminals connected to the analysis network, generating an independent virtual desktop corresponding to the allocated VLAN ID, and providing the user terminal with the provided. Through this configuration, the present invention divides the access area (network) of the digital evidence analysis system into a public network and a private network, but individually assigns a VLAN (Virtual LAN ID) to the user terminal connected to the public network and provides it to the user terminal. It is characterized by an effect of improving security.

Another disclosed prior patent document is “Apparatus and method for collecting digital data based on digital forensics” (Registration No. 10-1870670, hereinafter referred to as Patent Document 2)”.

The invention according to Patent Document 2 discloses an apparatus and method for collecting digital data based on digital forensics. According to an embodiment of the present invention, a data collection device based on digital forensics includes an evidence collection unit that collects evidence data from the controlled collection target device by controlling the operation of the collection target device, a display unit that displays a first image displayed by the controlled collection target device on the screen of the controlled collection target device based on the controlled operation, and an image capture unit that captures a second image related to the surrounding environment of the controlled collection target device; It is characterized by comprising: an image generator to generate image data by combining at least one of the displayed first image, the captured second image, and the third image; a hash calculator to calculate a first hash value for the generated image data; a user data generator to generate user data by combining the calculated first hash value with image information of the image data; and a container file storage unit to store a container file including the generated image data and the generated user data.

In the case of Patent Document 1 and Patent Document 2, the technical idea for digital forensic-based evidence data collection and analysis is disclosed.

However, in the case of the technology of Patent Document 1, since it includes the first network, the second network, and the third network, and separates the access area according to each network, it is a digital evidence analysis system with a complex form, and automatically extracts and analyzes digital data. The technical idea is insufficient.

In the case of Patent Document 2, it relates to a device and method for setting up an environment for collecting digital data based on digital forensics and managing the collected digital data together, and focuses on a device that simply collects data based on digital forensics. There is no technical idea about a series of processes for copying and analyzing digital data.

In addition, in the case of existing prior literature, it is not possible to select target data necessary to collect evidence data contained in digital devices, and it takes a lot of time to secure evidence because the entire PC is brought in to analyze and classify a vast amount of data. There is a problem.

Registration No. 10-1288034 Registration No. 10-1870670

The forensic system capable of selectively extracting and analyzing target data through remote networking according to the present invention has been devised to solve the above-mentioned conventional problems, and presents the following problems to be solved.

First, we want to select target data through remote networking without going to the field.

Second, efficient analysis is performed by selectively analyzing and salting the selected target data according to a predetermined analysis value.

Third, the target data to be subscribed to is selectively designated and analyzed to monitor the analyzed data.

The problems to be solved in the present invention are not limited to those mentioned above, and other problems not mentioned will be clearly understood by those skilled in the art from the description below.

The forensic system capable of selectively extracting and analyzing target data through remote networking according to the present invention has the following means for solving the above problems.

A forensic system capable of selectively extracting and analyzing target data through remote networking according to the present invention includes a data management unit that is networked remotely connected to an original repository, selects target data from the original repository, and selectively analyzes the target data to calculate analysis data; a user terminal unit having the source storage, remotely networked to the data management unit, and remotely and selectively extracting the target data by the data management unit; and a monitoring unit connected to the data management unit through a network, receiving the analysis data, and selectively monitoring the analysis data.

The data management unit of the forensic system capable of selectively extracting and analyzing target data through remote networking according to the present invention may be interconnected with the original storage when the user terminal unit receives an access right to the original storage.

The data management unit of the forensic system capable of selectively extracting and analyzing target data through remote networking according to the present invention includes a loading unit that selectively loads the target data to be duplicated among data existing in the user terminal unit; and an imaging unit generating image data by duplicating the target data selectively loaded from the loading unit.

The imaging unit of the forensic system capable of selectively extracting and analyzing target data through remote networking according to the present invention may copy the target data at preset cycles and generate the image data at preset cycles.

The data management unit of the forensic system capable of selectively extracting and analyzing target data through remote networking according to the present invention,

The method may further include an analyzing unit configured to selectively analyze the image data generated by the imaging unit based on preset analysis listing information and calculate the analysis data.

The user terminal unit of the forensic system capable of selectively extracting and analyzing target data through remote networking according to the present invention may optionally set security data among the target data and selectively restrict access to the security data from the data management unit.

The user terminal unit of the forensic system capable of selectively extracting and analyzing target data through remote networking according to the present invention selectively extracts export information of the security data and provides it to the data management unit.

When the monitoring unit of the forensic system capable of selectively extracting and analyzing target data through remote networking according to the present invention receives access permission from the data management unit, it interworks with the data management unit and receives the analysis data calculated from the reporting unit.

The monitoring unit of the forensic system capable of selectively extracting and analyzing target data through remote networking according to the present invention may include a designated monitoring unit that selectively designates the user terminal unit to be subscribed to and selectively receives only the analysis data of the designated user terminal unit.

The monitoring unit of the forensic system capable of selectively extracting and analyzing target data through remote networking according to the present invention may further include a pattern monitoring unit that calculates a pre-analyzed action pattern by selectively analyzing an action pattern of a user using the user terminal unit from the analysis data.

The forensic system capable of selectively extracting and analyzing target data through remote networking according to the present invention configured as described above provides the following effects.

First, it is networked remotely with the original repository, and it is possible to select and analyze target data from the original repository.

Second, the original repository can selectively protect data that is concerned about information leakage by selectively designating data that needs protection and restricting access.

Third, it is possible to selectively monitor desired analysis data by selectively designating a user terminal unit to be subscribed to.

Fourth, it is possible to calculate the pre-analyzed action pattern of the user through data analysis, and to monitor the case of deviation from the pre-analyzed action pattern.

The effects of the present invention are not limited to those mentioned above, and other effects not mentioned will be clearly understood by those skilled in the art from the description below.

1 is a conceptual diagram of a forensic system capable of selectively extracting and analyzing target data through remote networking according to an embodiment of the present invention.
2 is a conceptual diagram of a loading unit and an imaging unit of a forensic system capable of selectively extracting and analyzing target data through remote networking according to an embodiment of the present invention.
3 is a conceptual diagram of an analyzing unit of a forensic system capable of selectively extracting and analyzing target data through remote networking according to an embodiment of the present invention.
4 is a conceptual diagram of a chart generating unit of a forensic system capable of selectively extracting and analyzing target data through remote networking according to an embodiment of the present invention.
5 is a conceptual diagram of a user terminal unit of a forensic system capable of selectively extracting and analyzing target data through remote networking according to an embodiment of the present invention.
6 is a conceptual diagram of a designated monitoring unit of a forensic system capable of selectively extracting and analyzing target data through remote networking according to an embodiment of the present invention.
7 is a block diagram of a forensic system capable of selectively extracting and analyzing target data through remote networking according to an embodiment of the present invention.

Since the forensic system capable of selectively extracting and analyzing target data through remote networking according to the present invention can have various changes and various embodiments, specific embodiments will be illustrated in the drawings and described in detail in the detailed description. However, this is not intended to limit the present invention to specific embodiments, and should be understood to include all modifications, equivalents, or substitutes included in the technical spirit and scope of the present invention.

1 is a conceptual diagram of a forensic system capable of selectively extracting and analyzing target data through remote networking according to an embodiment of the present invention. 2 is a conceptual diagram of a loading unit and an imaging unit of a forensic system capable of selectively extracting and analyzing target data through remote networking according to an embodiment of the present invention. 3 is a conceptual diagram of an analyzing unit of a forensic system capable of selectively extracting and analyzing target data through remote networking according to an embodiment of the present invention. 4 is a conceptual diagram of a chart generating unit of a forensic system capable of selectively extracting and analyzing target data through remote networking according to an embodiment of the present invention. 5 is a conceptual diagram of a user terminal unit of a forensic system capable of selectively extracting and analyzing target data through remote networking according to an embodiment of the present invention. 6 is a conceptual diagram of a designated monitoring unit of a forensic system capable of selectively extracting and analyzing target data through remote networking according to an embodiment of the present invention. 7 is a block diagram of a forensic system capable of selectively extracting and analyzing target data through remote networking according to an embodiment of the present invention.

As shown in FIG. 1, a forensic system capable of selectively extracting and analyzing target data through remote networking according to the present invention relates to a system for transmitting, receiving, receiving, and monitoring target data by being networked remotely to an original repository.

For example, it is network-connected to an unspecified number of servers, allowing remote access to original storage existing in the servers. It is preferable to define the original storage as devices such as networks, databases, servers, disk devices, mobile terminals (personal computers, PCs, laptops, notebooks, tablet PCs, smartphones), hubs, switches, and routers used by companies or governments.

In the present invention, an analysis terminal, an analysis server, or an analysis cloud may be connected to the original storage by networking, and an image file may be created by imaging all physical sectors of target data transmitted and received from the original storage as copies, and the original of the target data may be secured.

Such an analysis terminal, analysis server, or analysis cloud borrowed the analysis data automatic generation system described in a previously filed patent, Registration No. 10-2294926 (2020 Small and Medium Business Technology Innovation Competition, Presidential Prize in Technology Protection). The purpose, function, and technical characteristics of the analysis terminal of the present invention are already known in prior patents filed previously, and detailed descriptions will be omitted here.

In the case of a forensic system capable of selectively extracting and analyzing target data through remote networking according to the present invention, as shown in FIG. 1, it includes a data managing unit (100), a user terminal unit (200), and a monitoring unit (300).

First, in the case of the data management unit 100, it is configured to be networked remotely to the original storage, select target data from the original storage, and selectively analyze the target data to calculate analysis data.

The data management unit 100 is provided in an analysis terminal for analyzing target data, an analysis server, or an analysis cloud, and transmits/receives target data from an original storage.

Target data here refers to all data existing in the source repository and data to be analyzed from the source repository. Since the type and amount of data to be processed in the analysis process is large and the required survey data varies depending on the situation, only the data necessary for the survey is selected.

In addition, when the data management unit 100 is authorized to access the original storage of the user terminal unit 200, it is preferable to interconnect with the original storage.

The data management unit 100 of the forensic system capable of selectively extracting and analyzing target data through remote networking according to the present invention includes a loading unit 110, an imaging unit 120, an analyzing unit 130, a salting unit 140, and a reporting unit 150.

First, in the case of the loading unit 110, as shown in FIG. 2, it is configured to selectively load target data to be duplicated among data existing in the user terminal unit 200.

In the case of the imaging unit 120, as shown in FIG. 2, it is a configuration for generating image data by duplicating target data selectively loaded from the loading unit 110.

The imaging unit 120 may physically copy the target data in the same form to another device or create an image file to prevent the target data from being changed. An image file can be created by imaging all physical sectors of the target data as copies, and it is desirable to secure the original of the target data.

In order to generate image data in the imaging unit 120, the target data is mapped to a hash table via a hash function, and one day data is loaded via the hash function. The hash function is used to prove that the duplicate and the original are the same and to verify the integrity of the data, which is already known in the previously filed patents mentioned above, and detailed mechanisms will be omitted.

In addition, the imaging unit 120 copies target data at each preset cycle to generate image data at each preset cycle.

The preset cycle referred to here may be defined as copying target data at regular intervals. For example, when the preset cycle is 1 minute, the imaging unit 120 may copy target data from the original storage every 1 minute and generate new image data every 1 minute.

In the case of the analyzing unit 130, the image data generated by the imaging unit 120 is selectively analyzed based on preset analysis listing information to calculate analysis data.

Since the type and amount of data to be processed in the data analysis process is large and the data to be investigated is different as needed, the pre-set analysis listing information reduces the amount of data to be analyzed and enables efficient and rapid analysis by selecting the data necessary for the investigation in advance. In general, preset analysis listing information is divided into classification according to time information, forgery and alteration data classification, application program file classification, and classification method according to owner, and detailed analysis can be performed based on the classified result.

The analyzing unit 130 includes an option analysis unit 131, a keyword analysis unit 132, and an extension analysis unit 133.

First, in the case of the option analysis unit 131, as shown in FIG. 3, before analyzing data, at least one or more of the preset analysis options are specified to index target data collected from the original storage and selectively list to calculate analysis data.

Here, the preset analysis options are analysis conditions for analyzing target data, and the preset analysis options include, for example, registry, event log, activity cache, link file, jump file, web browser, sticky note, messenger, file system log, and e-mail.

The option analyzer 131 selects at least one or more preset analysis options to analyze the target data, indexes the target data, and selectively lists the target data.

In addition, it is preferable that the option analyzer 131 select additional options such as collection options for indexing target data, such as storage of analysis targets, storage of hashes, and carving of deleted data.

In the case of the keyword analysis unit 132, as shown in FIG. 3, analysis data is calculated by specifying at least one or more keywords among preset analysis keywords prior to data analysis to index target data collected from the source storage and selectively listing them.

In the case of a preset analysis keyword, as a keyword for indexing target data, at least one keyword for necessary data can be designated and set.

In addition, when there are two or more analysis keywords preset in the keyword analysis unit 132, a logical operator (and, or, not), an adjacency operator (adj, near), a truncation operator (*, ?), etc. are selectively used to set a preset analysis keyword. It is preferable to set.

In the case of the extension analyzer 133, as shown in FIG. 3, by specifying at least one or more of the preset analysis extensions before data analysis, target data collected from the original storage is indexed and selectively listed to calculate analysis data.

Preset analysis extensions are for indexing only files with extensions that require analysis among target data. Preset analysis extensions include bmp, gif, jpg, png, psd, raw, tiff, avi, mkw, mov, mp3, mp4, wma, doc, docx, html, hwp, pdf, txt, exe, zip, ppt, xls, etc. Designate as an analysis extension to analyze target data.

In addition, when there are two or more preset analysis extensions in the extension analysis unit 133, it is preferable to set a preset analysis extension by selectively using a logical operator (and, or, not), an adjacency operator (adj, near), a truncation operator (*, ?), and the like.

In addition, in the analyzing unit 130, imaging and analysis of image data can be performed at the same time, and it is preferable to list the contents of each job and monitor the job status in real time.

In the case of the salting unit 140, a predetermined analysis value is extracted from the analysis data calculated by the analysis unit 130, and the analysis data is selectively salted.

The salting unit 140 is also provided in the analysis terminal to salt and visualize predetermined analysis values such as result values, numerical values, statistics, errors, categories, usage amounts, dates, names, extensions, and keywords that can be extracted from analysis data.

In the case of the salting unit 140 of the forensic system capable of selectively extracting and analyzing target data through remote networking according to the present invention, a table generator 141 and a chart generator 142 are included.

The table generating unit 141 is a component that filters the analysis data calculated from the analyzing unit 130 under preset conditions, extracts predetermined analysis values, and selectively salts the predetermined analysis values into a predetermined table.

Here, the pre-set conditions may be defined as conditions such as analysis target period, program installation record, analysis target storage device, analysis target volume, analysis target extension, keyword, usage record, and the like.

The table generating unit 141 allows analysis data to be set in a predetermined table when a pre-set condition is specified.

For example, an analysis result may be displayed by salting program installation record data with installation date, program name, distributor, and the like in a predetermined table.

In the case of the chart generating unit 142, as shown in FIG. 4, a predetermined analysis value is extracted by filtering the analysis data calculated from the analyzing unit 130 under preset conditions, and a predetermined analysis value is selectively salted to a predetermined chart.

The chart generation unit 142 filters the data by selecting at least one preset condition among analysis target period, program installation record, analysis target storage device, analysis target volume, analysis target extension, keyword, and usage record, and forms a predetermined chart in which the x-axis is the date and the y-axis is the time.

For example, as shown in FIG. 4, a predetermined chart is preferably formed as a bubble or bubble chart, and a predetermined analysis value can be mapped to a bubble point based on a predetermined date.

At least one type of an action type, a file type, or a storage type of a predetermined analysis value may be selectively mapped to a predetermined chart through bubble points.

The action types generated here include execution, operation, movement, deletion, modification, alteration, copying, copying, falsification, exporting, access recording, access count, installation, arrangement, opening, log recording, etc. of the analyzed data. File types include file extensions such as bmp, gif, jpg, png, psd, raw, tiff, avi, mkw, mov, mp3, mp4, wma, doc, docx, html, hwp, pdf, txt, exe, zip, ppt, and xls. Storage types include storage locations, storage devices, and the like, such as D drive, C drive, USB, hard disk, and cloud.

The chart generator 142 may selectively adjust the size of bubble points according to the volume of each action type, file type, and storage type of a predetermined analysis value, and map the bubble points to a predetermined chart.

The chart generator 142 may form a predetermined chart according to time by date for the analysis target extension. At this time, the size of the bubble point can be selectively adjusted according to the volume occupied by the file type of the analysis target, and the size can be mapped differently according to the volume (usage amount, amount of use, amount of activity) of the file type according to time and date.

For example, as shown in FIG. 4, since the volume of the file type at 10-12 o'clock and the file type volume at 14 o'clock on the date of 1900-01-01 are mapped to different sizes, it can be analyzed that the amount of usage or activity of the DOC file is greater at 10-12 o'clock.

In addition, the chart generation unit 142 may map electromagnetic waves of a preset wavelength band according to each action type, file type, or storage type of a predetermined analysis value to be selectively emitted.

In the electromagnetic wave of the preset wavelength range referred to here, the wavelength of the electromagnetic wave to be emitted can be selectively designated according to the action type, file type, or storage type of the value.

For example, as shown in FIG. 4, among the storage types to be analyzed, E; is an electromagnetic wave in a 450-495 nm region, H; is an electromagnetic wave in a 570-590 nm region, and J: is an electromagnetic wave in a 495-570 nm region.

The chart generation unit 142 emits and maps different electromagnetic waves according to the types of action types, file types, and storage types of the analysis target, so that each type can be visually distinguished.

In the case of the reporting unit 150, analysis data of at least one of operating system information, system event records, program installation records, storage device usage records, storage device lists, web records, link file records, shellback records, or activity caches salted according to conditions set in advance by the salting unit 140 can be extracted into a file in a preset format and selectively exported.

The reporting unit 150 extracts and generates desired information from among each analysis data in a desired file format, and may export the information to the outside.

The analysis data generated by the reporting unit 150 is already known in the previously filed patents, and a detailed description thereof will be omitted here.

In addition, the analysis result data generated by the reporting unit 150 is preferably outputted in a readable format so that not only experts but also ordinary people can easily understand.

In the case of the user terminal unit 200, as shown in FIG. 5, it has an original storage and is networked remotely to the data management unit 100, and the target data is remotely and selectively extracted by the data management unit 100.

As described above, the user terminal unit 200 may be defined as a plurality of original storage interworking with servers, clouds, and networking of companies, governments, and various organizations.

The user terminal unit 200 arbitrarily sets security data among target data so that access to the security data from the data management unit 100 can be selectively restricted. To prevent external leakage, the user of the original storage can selectively set it.

Instead, the user terminal unit 200 may selectively extract export information of security data and provide it to the data management unit 100 .

The export information referred to herein is defined as the execution, operation, movement, deletion, modification, change, copy, duplication, tampering, export, access record, number of times of access, installation, arrangement, opening, log record, etc. of security data.

The user terminal unit 200 does not provide security data to the data management unit 100, but instead provides export information so that the user can monitor security data being leaked, and corporate or government confidential information. It is to prevent leakage through another route.

In the case of the monitoring unit 300, it is a component that is connected to the data management unit 100 through networking, receives analysis data, and selectively monitors the analysis data.

The monitoring unit 300 is provided in the terminal of an authorized administrator so that the administrator can monitor the source storage.

In addition, when the monitoring unit 300 receives access permission from the data management unit 100, it can interoperate with the data management unit 100 and receive analysis data calculated from the analyzing unit 130.

In the case of the monitoring unit 300 of the forensic system capable of selectively extracting and analyzing target data through remote networking according to the present invention, a designated monitoring unit 310 and a pattern monitoring unit 320 are included.

In the case of the designated monitoring unit 310, as shown in FIG. 6, it is configured to selectively designate a user terminal unit 200 to be subscribed to and selectively receive only analysis data of the user terminal unit 200.

The designated monitoring unit 310 enables selective designation of at least one user terminal unit 200 among information on a plurality of user terminal units 200 networking with the data management unit 100 .

For example, the designated monitoring unit 310 monitors only the specific user terminal unit 200 to efficiently monitor target data of the specific user terminal unit 200, when leakage of trade secrets or internal employee information is suspected among a plurality of user terminal units 200.

In the case of the pattern monitoring unit 320, it is a component that selectively analyzes an action pattern of a user using the user terminal unit 200 from analysis data and calculates a pre-analyzed action pattern.

The pre-analyzed action pattern in the pattern monitoring unit 320 is to pattern a storage device, file, extension, web browser, messenger, e-mail, link file record, shellback record, activity record, activity time, usage time, usage history, etc. frequently used by the user using the user terminal unit 200 for a certain period into an action pattern.

The pattern monitoring unit 320 recognizes the analyzed data as an odd pattern when it deviates from the pre-analyzed action pattern, thereby confirming that the user's action pattern is different from the usual one, and preventing data from being leaked from the original storage to the outside in advance.

The scope of rights of the present invention is determined by the matters described in the claims, and parentheses used in the claims are not described for selective limitation, but are used for clear components, and descriptions in parentheses are also essential components. It should be interpreted.

100: data management unit
110: loading unit
120: imaging unit
130: analyzing unit
131: option analysis unit
132: keyword analysis unit
133: extension analysis unit
140: salting part
141: table creation unit
142: chart generator
150: reporting unit
200: user terminal unit
300: monitoring unit
310: designated monitoring unit
320: pattern monitoring unit

Claims (10)

a data management unit remotely connected to an original storage by networking, selecting target data from the original storage, selectively analyzing the target data, and calculating analysis data;
a user terminal unit having the source storage, remotely networked to the data management unit, and remotely and selectively extracting the target data by the data management unit; and
A forensic system capable of selectively extracting and analyzing target data through remote networking, characterized in that it comprises a monitoring unit connected to the data management unit through networking, receiving the analysis data, and selectively monitoring the analysis data.
The method of claim 1, wherein the data management unit,
A forensic system capable of selectively extracting and analyzing target data through remote networking, characterized in that when the user terminal unit receives access rights to the original storage, it is interconnected with the original storage.
The method of claim 2, wherein the data management unit,
a loading unit selectively loading the target data to be duplicated among data existing in the user terminal unit; and
A forensic system capable of selectively extracting and analyzing target data through remote networking, characterized in that it comprises an imaging unit generating image data by replicating the target data selectively loaded from the loading unit.
The method of claim 3, wherein the imaging unit,
A forensic system capable of selectively extracting and analyzing target data through remote networking, characterized in that the target data is copied at each preset cycle and the image data is generated at each preset cycle.
The method of claim 3, wherein the data management unit,
A forensic system capable of selectively extracting and analyzing target data through remote networking, characterized in that it further comprises an analyzing unit that selectively analyzes the image data generated from the imaging unit based on preset analysis listing information and calculates the analysis data.
The method of claim 1, wherein the user terminal unit,
A forensic system capable of selectively extracting and analyzing target data through remote networking, characterized in that by arbitrarily setting security data among the target data to selectively restrict access to the security data from the data management unit.
The method of claim 6, wherein the user terminal unit,
A forensic system capable of selectively extracting and analyzing target data through remote networking, characterized in that the export information of the security data is selectively extracted and provided to the data management unit.

The method of claim 5, wherein the monitoring unit,
When access permission is received from the data management unit, the forensic system capable of selectively extracting and analyzing target data through remote networking, characterized in that it interworks with the data management unit and receives the analysis data calculated from the analyzing unit.
The method of claim 8, wherein the monitoring unit,
A forensic system capable of selectively extracting and analyzing target data through remote networking, characterized in that it includes a designated monitoring unit that selectively designates the user terminal unit to be subscribed to and selectively receives only the analysis data of the designated user terminal unit.
The method of claim 8, wherein the monitoring unit,
A forensic system capable of selectively extracting and analyzing target data through remote networking, characterized in that it further comprises a pattern monitoring unit that selectively analyzes an action pattern of a user using the user terminal unit from the analysis data and calculates a pre-analyzed action pattern.