KR100901743B1 - Digital forensic system and method - Google Patents

Abstract

The present invention relates to a technique for analyzing and restoring digital evidence data of a mobile communication terminal. The digital forensic system of the present invention checks the JTAG port of the mobile device, connects the mobile device and the JTAG emulator, analyzes the file system of the flash memory mounted on the mobile device, and analyzes the data of the flash memory. Receiving a dump, and analyzing the dumped data to output evidence of the digital forensics.

Description

DIGITAL FORENSIC SYSTEM AND METHOD

1 is a block diagram illustrating a digital forensic system according to the present invention;

2 is a block diagram showing the forensic server shown in FIG.

3 is a block diagram illustrating a target board shown in FIG. 1;

4 is a flowchart illustrating a digital forensic method according to the present invention;

FIG. 5 is a diagram illustrating a connection between a target board and a JTAG port illustrated in FIG. 1;

6 is a flowchart for confirming the existence of a JTAG in the target board shown in FIG.

7 is a flowchart of extracting information from a flash memory of the target board shown in FIG. 4;

8 is a flowchart of generating evidence by analyzing information extracted from FIG. 7;

9 illustrates the evidence analyzed in FIG. 8.

* Description of the symbols for the main parts of the drawings *

10: target board 11: mobile device

12: flash memory 13: JTAG port

14: 24-pin port 20: JTAG emulator

30: forensic server 32: parallel port

33: serial port 34: USB port

100: digital forensic system

TECHNICAL FIELD The present invention relates to digital forensics, and more particularly to techniques for recovering and analyzing evidence data from portable information / communication devices.

Digital forensics is the technology of collecting and analyzing digital evidence. This digital forensic includes everything from collecting, preserving, analyzing, documenting, and submitting evidence to the trial process.

In the recent production and distribution of information, digital form of information accounts for more than 95%. With the development of digital technology, evidence of crime exists in a variety of places, including networks, the Internet, databases, and mobile devices. Portable personal digital devices, such as mobile phones, PDAs, electronic organizers, digital cameras, MP3 players, camcorders, and portable memory cards, are small and portable, making it easy to conceal crime evidence. Where evidence is needed, it is very important to obtain and analyze the necessary information from these personal digital devices and to obtain evidence of crime.

The process of collecting and analyzing digital evidence is technically complex and difficult, so the integrity and reliability of the evidence is determined by the analyst's expertise. There is an increasing need for research on various methodologies and digital forensic solutions for portable personal digital devices. Therefore, the participation of many IT professionals and the study of digital forensic technology are required to improve the level of digital evidence collection and analysis process.

It is therefore an object of the present invention to provide a digital forensic system and method thereof.

The present invention provides a digital forensic technique for analyzing and restoring digital evidence of a portable personal information / communication terminal or mobile device. In digital forensics, all information on a portable terminal is required, for example, product information of a mobile phone, user information, all stored data, an erased area, and a damaged area. The system and method of the present invention obtain such information from a portable terminal and generate it as digital evidence through an authorized analysis tool.

The digital forensic system according to the present invention includes a target board configured to mount a flash memory (or flash SSD). This target board has a memory controller. The forensic system of the present invention further includes a target board control device for transmitting a file system analysis code to the target board in response to the connection with the target board.

The memory controller operates in response to the transmitted file system analysis code and controls the flash memory so that all data stored in the flash memory is transmitted to the target board control device regardless of the mapping table stored in the flash memory. The file system analysis code includes a remapping instruction.

The memory controller analyzes file system information stored in a code area of the flash memory in response to the file system analysis code, and transmits the analyzed result to the target board control device. The memory controller also changes the mapping information for the deleted data in the flash memory in response to the remapping command to be read as undeleted data.

The target board controller converts the transmitted data, which is binary data, into meaningful data according to the transmitted analysis result. The analysis result includes folder and file structures of data stored in the flash memory, start and end addresses of each folder belonging to the folder structure, and header, data and trailer areas of a file structure belonging to each of the folders. .

The memory controller controls the flash memory so that data corresponding to the changed mapping information is transmitted to the target board control device.

The target board controller converts the data corresponding to the changed mapping information as the deleted data according to the transmitted analysis result.

The target board is connected to the target board control device through a JTAG port.

The target board control device includes a forensic server; And an emulator connected to the JTAG port and configured to interface the forensic server with the target board.

The target board is configured to mount a mobile device including a flash memory.

The mobile device of the target board is connected to the target board control device in a serial interface manner.

(Example)

Hereinafter, with reference to the accompanying drawings according to an embodiment of the present invention will be described in detail.

1 is a block diagram illustrating a digital forensic system according to the present invention. Referring to FIG. 1, the digital forensic system 100 includes a target board 10, a JTAG emulator 20, and a forensic server 30.

The target board 10 is configured to mount a mobile device 11 such as a cellular phone or a flash memory 4. The target board 10 has a JTAG port 13 and a standard 24-pin port 14. The JTAG emulator (Joint Test Action Group Emulator) 20 extracts the stored information from the flash memory 4 of the target board 10 in response to the control of the forensic server 30. The forensic server 30 controls the JTAG emulator 20 and analyzes the extracted information to generate evidence.

The forensic server 30 includes software for extracting information from the target board 10 using the JTAG emulator 20 and processing the extracted information. Accordingly, the digital forensic system 100 according to the present invention extracts and processes information stored in the target board 10 to provide evidence that can be used in court.

In addition, the forensic server 30 communicates by connecting a serial port (32) or a USB port (Universal Serial Bus Port: 33) and the standard 24-pin port 14 of the target board 10. In this case, information stored in the flash memory 4 of the target board 10 may be read or written using open software provided by the manufacturer of the target board 10.

When using open software provided by the manufacturer, reading information stored in the flash memory 4 is limited. For example, the forensic server 30 may extract text information, voice information, video information, picture information, a phone book, and the like from the non-deleted valid information from the flash memory 4. However, information about deleted information or call history (i.e., outgoing telephone number and incoming telephone number) and the like is unknown. The manufacturer of the target board 10 may provide information about deleted or call history through their software, but this may not only invade the privacy of the individual, but the manufacturer may not need to provide such information. Do not. In addition, since the target board 10 is manufactured by various manufacturers, respectively, the software provided by the manufacturers is not compatible with each other.

A detailed description of the forensic server 30 is referred to in FIG. 2.

FIG. 2 is a block diagram illustrating the forensic server shown in FIG. 1.

1 and 2, the forensic server 30 includes a forensic driver 40, an operating system (OS) 50, an evidence storage unit 60, a parallel port 31, a serial port (Serial). Port: 32), and USB port (Universal Serial BUS Port: 33).

The OS 50 refers to an operating system (eg, Windows XP or LINUX) that drives the forensic server 30. Here, the forensic server 30 will be described as an example running on Windows XP.

The evidence data storage unit 60 stores the data analyzed by the forensic driving unit 40.

The forensic driver 40 analyzes a file system stored in the NAND flash memory in the target board 10 and dumps the data stored in the NAND flash memory (FS_anal_code) 41. , Statistics / management report for statisticing, managing and reporting the data analyzed from the emulator function 42 for controlling the JTAG emulator 20, the data analysis function 43 for analyzing the dumped data, and the data analysis function 43 Function 44, Flash / DM function 45 for performing DM (ie, analytic observation) of flash memory, DB / log processing 46 for generating evidence storage 60, and The function blocks 41-46 are connected to a user interface (UI) to include a U / I block 47 that displays a processing state of the target board 10.

The forensic driver 40 is connected to the JTAG emulator 20 by the parallel port 31 or the serial port 32 and the USB port 31, and the serial port 32 or the USB port 33 is a target board. Supports all methods of connection with the standard 24-pin port 14 of (10).

3 is a detailed block diagram illustrating the target board of FIG. 1.

The present invention is illustrated based on a model between MSM6100 and MSM6500 provided by Qualcomm, a mobile processor. Qualcomm's Mobile Station Modem (MSM) chip includes an ARM processor. Depending on the model of the MSM chip, the ARM processor types and versions are different, so the instruction set controlling the flash memory is slightly different.

Referring to FIG. 3, the target board 10 includes a memory controller 1, a DRAM 2, and a NAND flash memory 4. The memory controller 1 embedded in a mobile of a code division multiple access (CDMA) type means an MSM chip provided by Qualcomm.

The memory controller 1 includes a TAP controller 8. The TAP controller 8 includes an instruction register (IR), a data register (DR), and the like. The state of the TAP controller 8 changes depending on the state of the TAP (Test Access Port). More specifically, the state of the TAP controller 8 may include JTAG ports such as TDI (Test Data In), TDO (Test Data Out), TMS (Test Mode Select), TCK (Test Clock), and TRST (Test Reset) port. It depends on the state.

The DRAM 2 serves as a main memory for driving the target board 10 and includes an empty space 3. The NAND flash memory 4 stores boot codes and data for driving the target board 10, and includes a code area 5, a data area 6, and an empty space area 7.

4 is a flowchart illustrating a digital forensic method according to the present invention.

The suspect or the suspect intentionally damages the mobile device in which his crime is stored in order to destroy his crime. The mobile device that stores the crime is used as evidence in court. Evidence stored on mobile includes photos, videos, call history, voice recordings, voice recorded calls, text messages, and phone books.

3 and 4, the user applies power to the mobile device to determine whether the mobile device performs a normal operation (410). If the mobile device performs normal operation even when the mobile device is damaged, the forensic server 30 determines whether a JTAG port exists on the main board 10 of the mobile device by connecting the emulator to the main board 10 of the mobile device. (420). When the mobile device does not perform a normal operation, the user detaches only the flash memory from the mobile device and mounts the flash memory on the target board (430). That is, the target board is a simulation board or evaluation board configured to have the same environment as the main board of the mobile device.

Most major mobile device manufacturers have a JTAG port on their main board. Manufacturers use JTAG ports to perform tests and analyze the main board of mobile devices. However, some mobile device manufacturers sell products that cannot connect to the JTAG port of the mobile device.

The JTAG emulator 20 determines whether a JTAG port exists in the mobile device (420). If the mobile device does not have a JTAG port, the flash memory mounted on the mobile device is removed and mounted on the evaluation board (430). When the mobile device has a JTAG port, the forensic server 30 analyzes the file system of the flash memory in the mobile device through the JTAG emulator 20 and dumps binary data stored in the flash memory (440). The forensic server 30 analyzes the dumped binary data (450).

A detailed method of confirming whether the JTAG port is mounted on the mainboard of the mobile will be described with reference to FIGS. 5 and 6. A detailed method of analyzing the file system of the NAND flash memory in the mobile and dumping binary data stored in the NAND flash memory will be described with reference to FIG. 7. A detailed method of analyzing the binary data dumped in FIG. 7 will be described with reference to FIG. 8.

FIG. 5 is a diagram illustrating a connection between a target board and a JTAG port illustrated in FIG. 1, and FIG. 6 is a flowchart illustrating the existence of a JTAG in the target board illustrated in FIG. 4.

Referring to FIG. 5, the target board 10 provides the VCC, nTRST, TDO, TDI, nQREQ, TCK, TMS, nSRESET, nHRESET, nCKSTOP, and nQACK ports as the JTAG port 13. The JTAG port 13 of the target board 10 is connected to the cable 21 of the JTAG emulator 20. The cable 21 of the JTAG emulator 20 in the present invention illustrates a standard 16 pin two row connector with a 2.54 mm pin spacing.

The nTRST, TDO, TDI, TCK, TMS, and nHRESET ports have a pullup resistor (Rpu). The pullup resistor has a resistance value of 10KΩ or 4.7KΩ. The nQACK port also has a pull-down resistor (Rpd). The pulldown resistor Rpd has a resistance of 100Ω.

Mobile device manufacturers that provide JTAG ports expose the nTRST, TDO, TDI, TCK, and TMS ports as JTAG's base interface, but do not disclose other ports. If you expose all the JTAG ports, the manufacturer's technology can be exposed.

Through the JTAG port of the target board 10, the JTAG emulator 20 checks which ports are not disclosed to control the target board 10. That is, the forensic server 30 inputs various patterns to the JTAG emulator 20 and analyzes the output signal to check the nPRESENT, nQREQ, nSRESET, nHRESET, nCKSTOP, and nQACK ports, and analyzes the output signal to be connected to the target board 10. Identify which ports are the ports. In addition, according to the method for confirming the existence of the JTAG port provided in FIG. To be connected.

For example, the present invention identifies the JTAG interface through eight pin definitions provided by Qualcomm. The nSRESET and nCKSTOP ports are not normally connected. The nQACK port has an internal ground voltage or pull-down resistor in the absence of an MSM chip. The output signal from the nQREQ port is active when the MSM chip is in low power or sleep mode. Alternatively, when the output signal is applied to the CKSTOP port, the MSM chip enters a check stop mode. That is, when the CKSTOP (check stop) signal is activated, an internal hard reset sequence occurs. The PRESENT pin is pulled down by the debugger when an external debugger is connected. That is, the present invention uses the characteristics of ports that are not disclosed to identify how many cable pins each port is connected to the JTAG emulator.

A description of the Joint Test Action Group (JTAG) emulator described in FIG. 6 follows the standard IEEE 1149.1-1990 and the IEEE Standard Test Access Port and Boundary-Scan Architecture.

3, 5, and 6, the JTAG emulator 20 sets the state of the TAP controller 8 of the target board 10 to a "Run Test Idle" state under the control of the forensic server 30. (421). The "Bypass" instruction is input to the instruction register IR (422). The TAP controller 8 sequentially passes signals input to the TDI port by the "Bypass" command and passes through the binary scan registers to the TDO port. The JTAG emulator 20 sequentially inputs an arbitrary data pattern to the TDI port under the control of the forensic server 30 (423). The JTAG emulator 20 determines whether the pattern coming out of the TDO port is the same as the pattern input to the TDI port (424). If the same, the target board 10 confirms the existence of the JTAG interface (425). Otherwise, the target board 10 confirms the absence of the JTAG interface (426).

FIG. 7 is a flowchart of extracting information from a flash memory of the target board shown in FIG. 4. 3 and 7, in response to the control of the forensic server 30, the memory controller 1 places a position of the empty block 7 in the empty block 3 or the flash memory 4 of the DRAM 2. Confirm (441).

In the empty block 3 of the DRAM 2 or the empty block 7 of the flash memory 4, the file system analysis code FS_anal_code stored in the forensic server 30 is stored through the JTAG emulator 20 (442). . The file system analysis code FS_anal_code consists of an instruction set for analyzing a file system of a flash memory.

The file system analysis code FS_anal_code is executed by the memory controller 1 (443). The memory controller 1 checks the code area among the flash memory areas according to the file system analysis code FS_anal_code (444). The memory controller 1 analyzes the file system structure of the flash memory according to the file system analysis code FS_anal_code (445). For example, in the case of a NAND type flash memory, a start and end address, an address where picture data is stored, an address where video data is stored, an address where character data is stored, and deleted information are stored in a data area from a file system of the memory. Analyze information about addresses. The memory controller 1 returns the analyzed information to the forensic server 30 (446). The memory controller 1 dumps binary data of the flash memory to the forensic server 30 (447).

For example, if any information is deleted in the NAND flash memory, the mapping table of the NAND flash memory marks the deleted information as unreadable. This means that it is impossible to read the deleted information by the conventional method.

Therefore, a method of remapping an erase region in the displayed mapping table is implemented by using a FTL (Flash Translation Layer) structure for improving performance of the NAND flash memory among the characteristics of the file system structure of the NAND flash memory.

The memory controller 1 may perform a command to remap the deleted information display according to the file system analysis code FS_anal_code and dump all data information including the deleted information to the forensic server 30.

In addition, the JTAG emulator 20 performs a function of a debugger. That is, the JTAG emulator 20 may directly control the memory management unit (MMU) included in the memory controller 1 to dump all data including the deleted information to the forensic server 30.

The memory controller 1 checks the code area among the NAND flash memory areas according to the file system analysis code FS_anal_code, and analyzes the file system of the NAND flash memory stored in the code area. That is, the binary data dumped through the analysis of the file system of the NAND flash memory can be converted into meaningful data.

FIG. 8 is a flowchart of generating evidence by analyzing information extracted from FIG. 7, and FIG. 9 is a diagram illustrating evidence analyzed in FIG. 8.

3 and 8, the forensic server 30 stores binary data. The forensic server 30 checks the entire structure of the dumped binary data (451). That is, the forensic server 30 checks the structure of the binary data through analysis of the file system of the flash memory analyzed in FIG. 7. For example, the forensic server 30 checks the structure of a folder of binary data and the file type of each folder.

The forensic server 30 analyzes a block / page map and converts binary data into meaningful data (452). For example, FIG. 9 illustrates data obtained by converting binary data. The directory "SKY \ SMS \ RECV" contains the file "RecvData0000". The highest 8 bytes of the "RecvData0000" file means the start of the message, 32 bytes means information about the receiver / sender, 240 bytes means information about the contents of the message, and 12 bytes means information on the reception / transmission. Information means 6 bytes means the end of the message.

NAND flash memory consists of several blocks. Each block is divided into several fixed-size pages. The NAND flash memory performs a read operation, a write operation, an erase operation, a copyback, and the like. A read operation simply reads content from flash memory and a write operation simply writes content to flash memory. These tasks are all paged. The erase operation works in units of blocks, and when a new operation needs to be written to the flash memory, the memory contents are removed for this purpose. Copyback is the ability to copy from one page to another page in a flash memory chip. Each page has a few bytes of "spare area" for recording out-of-band data.

One disadvantage of flash memory is that it is impossible to overwrite. In other words, if a page is changed, the page cannot be overwritten immediately, and a new page must be allocated to store new data. This means that when new content is written to a new page, the old page must immediately become obsolete. In other words, when an erase operation is performed on random data in the flash memory, the random data is not actually deleted but stored in another page.

Referring again to FIGS. 3 and 8, the forensic server 30 analyzes a block / page map to determine whether there is a deleted region in the analyzed file (453). The forensic server 30 determines whether there is a deleted area (454).

For example, if there is a deleted area in the flash memory, a command for remapping the deleted mark is used to dump the deleted area. Therefore, if it is determined whether the remapping command is used, it may be determined whether the deleted area is present.

If there is a deleted region, the forensic server 30 checks the deleted region using the analyzed data and restores the deleted data (455). If not, the forensic server 30 reports the evidence using the analyzed data (456).

For example, if the remapping command is used to dump the deleted area of the flash memory, the mapping table that stores the address of the deleted data is modified by the remapping command. Therefore, the forensic server 30 checks the address where the data of the deleted region is stored by using the modified mapping table, reads the address, and restores the deleted data.

In the above, the best embodiment has been disclosed in the drawings and the specification. Although specific terms have been used herein, they are used only for the purpose of describing the present invention and are not used to limit the scope of the present invention as defined in the meaning or claims. Therefore, those skilled in the art will understand that various modifications and equivalent other embodiments are possible from this. Therefore, the true technical protection scope of the present invention will be defined by the technical spirit of the appended claims.

According to the present invention described above, it is possible to successfully perform digital forensics from various mobile devices.

Claims (15)

A target board including a memory controller, the target board configured to mount a NAND flash memory; And A target board control device for transmitting a file system analysis code for analyzing a file system of the NAND flash memory to the target board in response to a connection with the target board, The memory controller of the target board operates in response to the transmitted file system analysis code, and transmits the data stored in the NAND flash memory to the target board control device regardless of the mapping table stored in the NAND flash memory. Digital forensic system to control memory. The method of claim 1, And the memory controller analyzes file system information stored in a code area of the NAND flash memory in response to the file system analysis code, and transmits the analyzed result to the target board controller. The method of claim 2, The file system analysis code includes a remapping instruction, And the memory controller changes the mapping information for the deleted data of the NAND flash memory in response to the remapping instruction to be read as undeleted data. The method of claim 2, And the target board control device converts the transmitted data, which is binary data, into meaningful data according to the transmitted analysis result. The method of claim 4, wherein The analysis result includes folder and file structures of data stored in the NAND flash memory, start and end addresses of each folder belonging to the folder structure, and header, data and trailer areas of a file structure belonging to each of the folders. Digital forensic system. The method of claim 2, And the memory controller controls the NAND flash memory so that data corresponding to the changed mapping information is transmitted to the target board control device. The method of claim 6, And the target board control device converts data corresponding to the changed mapping information as the deleted data according to the transmitted analysis result. The method of claim 1, The target board is connected to the target board control device through a JTAG port digital forensic system. The method of claim 1, The target board control device A forensic server; And And an emulator coupled to the JTAG port, the emulator configured to interface the forensic server and the target board. The method of claim 1, The target board is configured to mount a mobile device including the NAND flash memory. The method of claim 10, And the mobile device of the target board is connected to the target board control device in a serial interface manner. a) transmitting a file system analysis code for analyzing a file system of the NAND flash memory to the target board in response to a connection with the target board including the NAND flash memory; And b) transmitting data stored in the NAND flash memory to a target board control device regardless of the mapping table stored in the NAND flash memory according to the transmitted file system analysis code. The method of claim 12, The transmission to the target board control device may include analyzing the file system information stored in the code area of the NAND flash memory in response to the file system analysis code, and transmitting the analyzed result to the target board control device. Way. The method of claim 13, The transfer to the target board controller further includes changing mapping information for the deleted data in the NAND flash memory in response to a remapping command included in the file system analysis code to be read as undeleted data. Way. The method of claim 13, And the transmitted data, which is binary data, is converted into meaningful data according to the transmitted analysis result.

Images