KR101082024B1 - Device for index managing of evidence image in digital forensic system and method therefor - Google Patents

Abstract

An index management technique of evidence images in a digital forensic system. The index management apparatus includes: a restoration unit for restoring the evidence image to digital data of the file system structure, a document number dictionary management unit for assigning a unique document number to each of the files belonging to the restored digital data and managing the document number dictionary; An indexing unit including an indexing unit for extracting an index word from a file of digital material and specifying a document number assigned to a file to which the index word belongs for each extracted index word; An index storage unit for storing index information in which document numbers for respective index words are designated by the index unit; And an index word search unit that checks a document number assigned to the index word to be searched by referring to the index database, and searches the corresponding file by referring to the document number dictionary with the confirmed document number.

Description

Device for index managing of evidence image in digital forensic system and method therefor}

It relates to a digital forensic system, and in particular to an indexing technique for fast retrieval of digital evidence.

This study was derived from a study conducted as part of the IT New Growth Engine Technology Development Project of the Ministry of Knowledge Economy and the Ministry of Information and Telecommunications Research and Development. [Task Management Number: 2007-S-019-02, Title: Information Transparency Guaranteed Digital Forensic System Development of Digital Forensic System for Information Transparency]

Digital forensic systems are systems for collecting, storing, analyzing, and reporting evidence from digital data stored on computers and digital equipment. It usually consists of duplication and image recognition of storage media, preservation of digital evidence, retrieval and analysis of digital evidence, and recovery of digital evidence. If the original digital evidence material is damaged or tampered with, it cannot be used as legal data. Therefore, copy and use the same as the original without damaging the original. This copy is commonly referred to as evidence image, and once created, the evidence image is immutable.

Meanwhile, in the forensic process of collecting, storing, analyzing, and reporting digital evidence, the process of imaging and collecting evidence data and analyzing the evidence from the evidence image takes a lot of time. The evidence image is indexed to reduce the time required for the double analysis process. However, since the conventional indexing method manages the file information for the index word as a file name including a directory, there is an overhead of processing the file name for each index step. For example, if you index the word "computer", it is found in the files "A.doc", "C.hwp", and "E.ppt." Then, for the word “computer”, you can use 'C: /abc/def/A.doc', 'C: /abc/deg/op/C.hwp', 'E: / kkk / ssl / esd / abd / ssc / It will be indexed like E.hwp '. This indexing method incurs an overhead in processing file names.

In addition, in order to index a file having a large size in the related art, a file is divided into small sizes, a temporary file name is assigned to each file, and an index is generated based on the divided files. After searching the index database, the search results for the divided files are displayed, which must be post-processed with the results found in one file. That way, you can properly search the file for index words.

In addition, if a temporary file name is assigned to the divided files, a problem of overlapping with the existing file name may occur. For example, the file 'A.doc' in the directory 'C: / abc / def /' is a large file, so it is divided into three files and 'A-1.doc', ' If a temporary file name is given, such as A-2.doc 'or' A-3.doc ', a problem may occur in which the temporary file name is duplicated with an existing file name.

It is an object of the present invention to provide an index management apparatus and method that can solve the overhead problem of processing a file name in a conventional indexing process.

It is also an object of the present invention to provide an index management apparatus and method that does not require post-processing.

It is also an object of the present invention to provide an index management apparatus and method for solving a file name duplication problem caused by dividing a file into small sizes and assigning a temporary file name for indexing a large file.

For the digital forensic investigation to achieve the above technical problem, the index management device for the evidence image copied in the same manner as the original, the restoration unit for restoring the evidence image to the digital data of the file system structure, the file belonging to the restored digital data A document number dictionary management unit for assigning a unique document number to each of them to manage the document number dictionary; An index unit including an index performer; An index storage unit for storing index information in which document numbers for respective index words are designated by the index unit; And an index word search unit that checks a document number assigned to the index word to be searched by referring to the index database and searches the corresponding file by referring to the document number dictionary with the confirmed document number.

The document number dictionary management unit has a feature of assigning a document number to each of file names including a directory belonging to a digital material and managing the document number dictionary.

An index unit extracts an index word for each file belonging to a digital material, and an index for integrating both the extracted index word and the document number assigned to the file from which the extracted index word is searched to generate index information for which the document number for each index word is specified. It includes an information generating unit.

The index word extractor extracts index words for each divided file after dividing a large number of files into large files when the capacity of the file to be indexed is larger than the indexable size at a time. The index information generator extracts index words extracted from the split files. Collect all of them and generate index information corresponding to document numbers assigned to large files.

On the other hand, the index management method for achieving the above-described technical problem comprises the steps of restoring the evidence image copied in the same manner as the original to the digital data of the file system structure in the process of collecting the digital forensic evidence material; Assigning a unique document number to each file included in the digital data of the restored file system structure and managing the document number dictionary; Extracting index words on a file basis from files included in the digital data of the restored file system structure; Generating index information corresponding to the extracted index word and the document number of the file and managing the index information in an index database; Identifying a document number assigned to an index word to be searched by referring to an index database; And searching the index word contained in the file by referring to the document number dictionary with the confirmed document number.

By sequentially assigning document numbers to file names including directories of evidence images and managing them with document number dictionaries, files can be numbered in the indexing process, reducing the overhead of processing file names for each index step. In addition, when a large file is divided and indexed and updated, a temporary file name is not given to each split file, so that a problem of overlapping with the existing file name does not occur, and further, post-processing of the search for the temporary file names is not necessary.

The foregoing and further aspects of the present invention will become more apparent through the preferred embodiments described with reference to the accompanying drawings. Hereinafter, the present invention will be described in detail to enable those skilled in the art to easily understand and reproduce the present invention.

1 is a block diagram of an index management apparatus according to an embodiment of the present invention.

First, the evidence image 100 to be indexed by the index management device refers to a material having a forensic characteristic in which all original digital data stored in a storage medium such as a hard disk are identically copied. The index management apparatus 200 is an apparatus for performing an index and an index search on the evidence image 100. The index management apparatus 200 includes a graphical user interface (GUI) 210, an index management unit 220, an index unit 230, an index database 240, and a search unit 250. GUI 210 is a graphical input / output interface for a user. The user may order creation, update, deletion, etc. of the index through the GUI 210. The index control unit 220 controls the generation, update, deletion, cancellation, etc. of the index, and also controls the search of the index. In one embodiment, the index control unit 220 controls an index operation or an index search operation according to a user's command through the GUI 210. The components of the index manager 220, the index 230, and the searcher 250 may be all implemented by program code.

The index unit 230 serves to generate, update, delete, and back up the index from the evidence image 100. The index unit 230 according to a characteristic aspect of the present invention extracts an index word from the evidence image 100 and designates and indexes a document number assigned to a file to which the index word belongs for each extracted index word. The index information by the index unit 230 is called a reverse file, which refers to a file or data structure indicating what document corresponds to the index word. This reverse file is stored in the index database 240. The search unit 250 checks at least one document number assigned to the index word to be searched based on the reverse file stored in the index database 240, searches for a file having the document number, and searches the index word within the file.

2 is a partial detailed configuration diagram of FIG. 1.

The indexing unit 230 includes a restoring unit 231, a document number dictionary management unit 232, and an index performing unit 233. The restoration unit 231 restores the evidence image 100 to the digital material 100-1 having the file system structure. This is because indexing is possible only after conversion to the file system structure.

The document number dictionary management unit 232 sequentially assigns a unique document number to each of the files of the digital material 100-1 having the file system structure restored by the restoration unit 231. FIG. In one embodiment, the document number dictionary management unit 232 sequentially assigns document numbers to file names including directories. This is illustrated in FIG. 3. In this way, if only the document number of the file is known, the storage location of the file can be grasped through the directory information, and the file can be known through the file name. The information about the document numbers assigned to the files is stored in the document number dictionary database 260 as document number dictionary and managed.

The index performer 233 extracts index words from files belonging to the digital material 100-1 having the file system structure restored by the restorer 231. The reverse file is generated and stored in the index database 240 through an index method for designating a document number assigned to a file to which the index word belongs for each index word extracted.

The search unit 250 checks the document number with reference to the index database 240 for the index word to be searched. And through the document number dictionary stored in the document number dictionary database 260 with the confirmed document number to check the file name including the directory. The search unit 250 searches for an index word in the file after finding the file from the digital data having the file system structure restored by the restoration unit 231 with the file name including the identified directory.

4 is a diagram illustrating a detailed configuration of the index performing unit 233 of FIG. 3.

The index performing unit 233 includes an index word extracting unit 233-1, an index word arranging unit 233-2, and an index information generating unit 233-3. The index word extracting unit 233-1 extracts an index word from files belonging to the digital data 100-1 of the file system structure. Index terms can be, for example, only nouns that form sentences in a document. The index word extractor 233-1 extracts all index words for each file, and the frequency calculator 233-1a included in the index word extractor 233-1 calculates a frequency for each index word for each file. Here, the frequency calculator 233-1 a has an additional configuration. The index word sorting unit 233-2 sorts the index word extracted by the index word extracting unit 233-1 and the frequency of each index word based on the index word for each file. For example, sorting index words alphabetically or alphabetically. An example of this is shown in FIG. 5. The index word aligning unit 233-2 may be omitted as an additional configuration. Although not illustrated in FIG. 5, a field for recording the frequency calculated by the frequency calculator 233-1a may be further added to each record. The table information as shown in FIG. 5 may be stored and managed separately instead of being used once and deleted. If the index word sorter 233-2 is not configured in the index performer 233, table information not sorted based on the index word in FIG. 5 may be separately stored and managed.

The index information generating unit 233-3 generates the reverse file by integrating the index word, the frequency, and the document number sorted by file by the index word arranging unit 233-2. When the index word arranging unit 233-2 is not configured, the index information generating unit 233-3 integrates the index word extracted for each file by the index word extracting unit 233-1 and the document number of the file to reverse the file. Create An example of an inverted file table is shown in FIG. 6. Preferably, the index information generation unit 233-3 sorts the records sequentially according to the order of the index, as illustrated in FIG. In this case, if the index word sorting is performed on a file basis by the index word sorting unit 233-2 first, the reverse file generation speed by the index information generating unit 233-3 can be accelerated.

In one embodiment, the index information generator 233-3 may first generate a reverse file for the first file and then update the reverse file stored in the index database 240 for the file. . In another embodiment, the index information generator 233-3 may generate a reverse file in units of several file groups, and then update the reverse file stored in the index database 240 for the file group. In another embodiment, the index information generator 233-3 may generate a reverse file for all files to be indexed at once.

On the other hand, because of the large file size, indexing may not be possible at one time. For example, assuming that the maximum size of a file that can be indexed at one time is 20MB, a file having a size of 50MB should be divided and indexed. Therefore, the index unit 230 divides the third divided into 20MB units, indexes the first divided file, additionally indexes and updates the second divided file, and additionally indexes and updates the remaining divided files. . Since the files in the evidence image do not change their contents, updating the index for a file of the same name is only a large index. If you divide a large number of files with the same name and then index them in separate file units, all the indexed results for each split file are combined and processed as a single document number.

For reference, in FIG. 4, after determining whether the index target file has a large capacity or not, the index word extracting unit 233-1 may divide the file and proceed with the index word extraction process. The index information generator 233-3 processes the files divided into one large file with the same document number. Even if the same document number is processed, the index data for one divided file is added to the index data of another divided file having the same document number, rather than being overwritten. That is, the index information generation unit 233-3 recognizes the same document number for the plurality of split files for one large file, and the index data for the second split file and the index data for the second split file. Update the reverse file by adding index data for the third split file.

According to an additional aspect of the present invention, the index information generator 233-3 may delete some index information of the reverse file. For example, when a user requests to delete index information for some directories or specific files, the index information generator 233-3 deletes all index information related to the document number to be deleted from the reverse file and reverse the file. Update the. In one embodiment, the index information generating unit 233-3 excludes the table information of the file to be deleted by referring to the table information as shown in FIG. 5 and integrates the table information for the remaining files to refresh the inverse file. Some index information may be deleted by generating and overwriting the index database 240.

7 is a flowchart of an index generation / update method according to an embodiment of the present invention.

When generating or updating index information on the evidence image, the index unit 230 restores the evidence image to digital data of a file system structure (step S700). Then, a unique document number is assigned to each of the files belonging to the digital material of the file system structure, and this is managed as a document number dictionary (step S710). Thereafter, the index unit 230 extracts an index word for each file and generates an inverted file composed of records including a document number field, an index word field, and a frequency field additionally by integrating the entire index word (step S720).

As a specific example for step S720, the indexing unit 230 first performs indexing on a file basis, and checks whether the file is a large file. If the file is not a large file, the index unit 230 extracts an index word from the file. In addition, the frequency of the extracted index word can be calculated. The index unit 230 sequentially sorts index words for each file. When the frequency is calculated, the frequency is also sorted together corresponding to the index, according to the sorting based on the index.

The index unit 230 generates an inverse file in which index words sorted by files and document numbers assigned to the files are designated. In the method of generating the reverse file, the index unit 230 may generate the reverse file at once for all the files to be indexed, and generate the reverse file in a predetermined number of file group units and then update the reverse file. You can also create a reverse file for one file that is the first index, and then update it.

On the other hand, if the file to be indexed is a large file, the index unit 230 divides the large file so that it can be indexed at once, and indexes each divided file unit. These divided files are recognized with the same document number, and the index information performed in each divided file unit is collected in association with one document number.

8 is a flowchart illustrating an index word search method according to an embodiment of the present invention.

If there is an index word search command, the index unit 230 confirms a document number for the index word to be searched (step S800). This can be confirmed through a reverse file stored in the index database 240. The index unit 230 then confirms the confirmation of the file with respect to the confirmed document number (step S810). This may be confirmed through a document number dictionary stored in the document number dictionary database 260. The index unit 230 searches for the identified file and searches for an index word within the searched file (step S820). The index word search result is output to be displayed through the GUI 230 (step S830).

On the other hand, although not shown in the flow chart, if there is a delete command for some index information, the index unit 230 reconstructs the reverse file so that all the index information associated with the document number to be deleted from the reverse file is deleted. The manner of deleting some index information is as mentioned.

So far I looked at the center of the preferred embodiment for the present invention. Those skilled in the art will appreciate that the present invention can be implemented in a modified form without departing from the essential features of the present invention. Therefore, the disclosed embodiments should be considered in an illustrative rather than a restrictive sense. The scope of the present invention is shown in the claims rather than the foregoing description, and all differences within the scope will be construed as being included in the present invention.

1 is a block diagram of an apparatus for managing an index according to an embodiment of the present invention.

Figure 2 is a partial detailed configuration example of FIG.

3 is an exemplary document number dictionary.

4 is a diagram illustrating a detailed configuration of an index performing unit of FIG. 2.

5 is an illustration of index word alignment.

6 is an inverted file example.

7 is a flowchart of an index generation / update method according to an embodiment of the present invention.

8 is a flowchart of an index word retrieval method according to an embodiment of the present invention;

<Explanation of symbols for the main parts of the drawings>

210: GUI 220: Index control unit

230: indexing unit 231: restoring unit

232: document number dictionary management unit 233: index execution unit

233-1: Index word extraction unit 233-2: Index word alignment unit

233-3: Index information generation unit 240: Index database

250: search unit 260: document number dictionary database

Claims (10)

delete An index management apparatus for evidence images copied identically to the original for digital forensic investigation, A reconstruction unit for reconstructing the evidence image into digital data of a file system structure, a document number dictionary management unit for assigning a unique document number to each of the files belonging to the reconstructed digital data to manage the document number dictionary, and the restored digital An indexing unit including an indexing unit for extracting an index word from a file of data and specifying a document number assigned to a file to which the index word belongs for each extracted index word; An index storage unit for storing index information for designating a document number for each index word by the index unit; And An index word search unit for checking a document number assigned to an index word to be searched by referring to the index database, and searching the corresponding file by referring to the document number dictionary with the identified document number; The document number dictionary management unit assigns a document number to each of file names including a directory belonging to the digital material, and manages the document number dictionary. The method of claim 2, The index unit combines all of the extracted index word and the document number assigned to the file from which the extracted index word is searched, and index information for specifying a document number for each index word. And an index information generating unit to generate. The method of claim 3, The extracting unit includes a frequency calculating unit calculating a frequency of the extracted index word for each file, And the index information generator generates a reverse file by additionally reflecting the frequency of index words for each index word and document number. The method of claim 3, The index unit may further include an index word sorting unit that sorts the extracted index words by files according to sorting criteria. And the index information generator generates index information after sorting by the index word sorter. The method of claim 3, The index word extracting unit extracts an index word for each divided file after dividing the large file into a plurality of files when the capacity of the file to be indexed is larger than the capacity that can be indexed at one time. The index information generation unit collects all index words extracted from the split files to generate index information corresponding to the document number assigned to the large file, splits the large file to index the first split file, and indexes the remaining split files. Index management apparatus, characterized in that for updating. The method of claim 3, And the index information generating unit reconfigures the index information stored in the index database so that index information related to the deleted designated document number is deleted when there is an index information deleting command associated with at least one document number. Restoring the evidence image copied in the same manner as the original to the digital data of the file system structure in the process of collecting the digital forensic evidence data; Assigning a unique document number to each file included in the digital data of the restored file system structure and managing the document number dictionary; Extracting index words on a file basis from files included in the digital data of the restored file system structure; Generating index information corresponding to the extracted index word and the document number of the file and managing the index information in an index database; Identifying a document number assigned to an index word to be searched by referring to the index database; And Searching the index word contained in the file with reference to the document number dictionary with the identified document number; including, The managing of the document number dictionary may include managing a document number dictionary by assigning a document number to each file name including a directory belonging to the digital material. The method of claim 8, The extracting of the index word may include checking whether the capacity of the file to be indexed is a large file larger than the capacity to be indexed at one time; splitting the large file into a plurality of large files, Further extracting index terms for each file, In the managing of the index database, the index information generating unit collects all index words extracted from the split files to generate index information corresponding to the document number assigned to the large file, and splits the large file into the first split file. Index management and updating the index of the remaining split files. The method of claim 8, Newly configuring index information stored in the index database such that index information relating to at least one document number is deleted if there is an instruction to delete index information related to at least one document number; Index management method characterized in that it further comprises.

Images