KR101710426B1 - Automated digital forensic system to identify the command history of the file - Google Patents

Abstract

The present invention relates to a digital forensic system that determines a command history by utilizing a log file recorded according to a file command in a Windows file system, and includes a collection module that extracts a timestamp before performance of a file command and information of the timestamp after the performance of the file command by loading a log file; a conversion module that compares the extracted timestamp information, calculates the change history into a timestamp change pattern, and outputs a binary code; and a forensic determination module that calculates the binary code to convert the binary code to a decimal code and decodes the decimal code into an allocated letter code. Accordingly, the present invention may reduce an analysis time of a target file in an automated manner without depending on manual work by an experience and an intuition of an analyst.

Description

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an automated digital forensic system,

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a digital forensic system for discriminating an instruction history of a file, and more particularly, to a digital forensic security system for discriminating an instruction history of a file using a log file recorded according to a file command in a Windows NTFS file system will be.

One of the most used computer operating system systems today is Microsoft's Windows. These windows have long been a stable file system, ranging from Windows XP to Windwos 10, with the NTFS file system as the default file system since the NT version.

The NTFS file system uses B-tree data structures to manage files in directories, making it efficient to handle many files and to find files quickly. And when the system is damaged or there is a hardware disk corruption, the file recovery function is excellent and it has security function through encryption. Here, the Windows NTFS file system records the timestamps in files managed by the file system based on the time at which the task was executed. From a digital forensic point of view, this timestamp is a very important factor in estimating what work to do and when. By using time stamps, it is possible to reconstruct the events occurring around certain events and to use them for forensics by time zone.

Digital forensics is defined as scientific and logical procedures and methods for collecting, archiving, analyzing, and reporting data. For the purpose, it is based on the digital data embedded in the computer, It is a technique to identify and verify relationships. To do this, it is necessary to obtain evidence without compromising the original digital data, to prove that the computer evidence existed at that time, to document the evidence and then to document it as evidence in court.

Therefore, the major investigative agencies in major countries and financial and insurance companies dealing with sensitive data recognize the importance of digital forensics field, and not only acquire experts and various related technologies, but also develop digital evidence collection methods, analysis methods, and search technologies . However, existing search tools simply present the results, so investigators had to spend a lot of time searching for documents related to the investigation.

Korean Patent Registration No. 10-1040765 entitled " Process and File Tracking System and Process and File Tracking Method Using Extended Security Label " Korean Patent Registration No. 10-1407060 entitled " Analysis and Evidence of Data Collected via the Internet, Data Analysis and Evidence System Using the Data " Korean Patent Publication No. 10-2011-0070767 "Network-based remote forensic system" Korean Patent Laid-Open Publication No. 10-2012-0065819 "Digital Forensic Device for User Activity Analysis and Method Thereof" Korean Patent Registration No. 10-1410442 entitled "Digital Forensic Audit System Based on User Behavior Analysis"

SUMMARY OF THE INVENTION It is an object of the present invention to provide an NTFS file system and a method thereof, which can solve the conventional problems as described above. The goal is to provide an automated digital forensic system that identifies the command history of a file that has easy accessibility compatibility and the ability to automatically and accurately analyze the file regardless of the capacity of the target file.

In order to achieve the above object, the present invention provides a digital forensic system for determining a command history of a file using a log file recorded in accordance with a file command in a Windows file system, the system comprising: A collection module for extracting information on the time stamp after the execution of the file command, information on the generation time, write time, modification time, and read time of the command execution object file by the standard information attribute group and the file name attribute group; The information extracted from the time stamp is compared with each other before and after the file command to calculate the time stamp change pattern distinguished by the non-change, the command execution time, the time information of the target file, and the standard information attribute time information of the target file, A conversion module for outputting the output signal; And a forensic discrimination module for calculating a binary code output according to the change pattern, converting the binary code into a single decimal code, assigning an instruction code to the decoded code, and outputting the decoded code.

delete

delete

delete

It should be understood, however, that the terminology or words of the present specification and claims should not be construed in an ordinary sense or in a dictionary, and that the inventors shall not be limited to the concept of a term It should be construed in accordance with the meaning and concept consistent with the technical idea of the present invention based on the principle that it can be properly defined. Therefore, the embodiments described in the present specification and the configurations shown in the drawings are merely the most preferred embodiments of the present invention, and not all of the technical ideas of the present invention are described. Therefore, It is to be understood that equivalents and modifications are possible.

As described above, according to the present invention, since it is not necessary to construct a separate analysis system by utilizing a log file recorded in accordance with a file command in the Windows NTFS file system, it is possible to reduce the cost, It does not need to be trained separately, and it provides the effect of automatically analyzing accurately regardless of the capacity of the target file.

1 is a block diagram generally showing a system according to the present invention;

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings.

The present invention relates to a system for determining command history of a file by utilizing a log file recorded in accordance with a file command in a Windows file system. The system includes a collection module 10, a conversion module 20, and a forensic discrimination module 30 It is an automated digital forensic system that determines the command history of a file to be composed. The system of the present invention realizes a function of determining which file command has been executed based on a change pattern of a time stamp recorded on the basis of the execution time of a job among files managed by the NTFS file system do.

First, the acquisition module 10 loads the log file and extracts the time stamp before the file command and the time stamp after the file command, respectively. Here, the time stamp is divided into an attribute group Si and a name group Fn with information on the generation time Tc, write time Tw, MFT correction time Te, and read time Ta of the target file. In other words, each of the four pieces of information (Tc, Tw, Te, Ta) of the time information of the time stamp before the file command ($ STANDARD_INFORMATION) and the file name ($ FILE_NAME) Extracts four pieces of information (Tc, Tw, Te, Ta) of attribute information of $ STANDARD_INFORMATION attribute time and file name ($ FILE_NAME).

Subsequently, the conversion module 20 compares the information of the extracted time stamps with each other, and outputs the changed details as a time stamp change pattern. That is, the information is calculated with no change (U), command execution time (T _op ), time information (T _src ) of the target file, and attribute time information (T _SIsrc ) of the standard information ($ STANDARD_INFORMATION) Output a binary value. The analysis module 20 is defined and output by the following function.

(b _{i + 1 '} b _i ) = F _TCC (t ^x _{Beforecommand'} t ^x _afterCommand )

The defined function converts the time stamp before the file command is executed and the change in the time stamp after the command is executed into a 2-bit code. That is, the four pieces of information Tc, Tw, Te, and Ta of the attribute information of the standard information ($ STANDARD_INFORMATION) extracted from the collection module 10 and the four pieces of information Tc, Tw, Te, Ta) are converted into 2-bit codes for each time stamp by all 8 TCC functions, and the number of bits to be converted is 16 bits. Here, x is used as a representative symbol for C (generation), W (writing), E (correction), and A (reading). Therefore one of $ SI (Tc, Tw, Te, Ta) or one of $ FN (Tc, Tw, Te, Ta) is applied.

For example, the time stamp information before the execution of the command and the time stamp information after the execution of the command are applied as inputs, and then output as a 2-bit code according to the changed form. One TCC includes four pieces of information Tc, Tw, Te, Ta of the standard information ($ STANDARD_INFORMATION) attribute time and four pieces of information Tc, Tw, Te, Ta of the file name ($ FILE_NAME) Specify 8 timestamps as arguments respectively. Each time stamp information is input at the same time as before the instruction execution and after the instruction execution.

At this time, there are four kinds of change patterns generated for each piece of time stamp information. These codes are expressed by assigning 2-bit codes to each of them. These types are divided into U (no change), command execution time (T _op ), time information (T _src ) of the target file, and attribute time information (T _SIsrc ) of the standard information of the target file ($ STANDARD_INFORMATION).

U → (b _{i + 1 '} b _i ) = (0, 0)

T _op → (b _{i + 1 '} b _i ) = (0, 1)

T _src → (b _{i + 1 '} b _i ) = (1, 0)

T _SIsrc → (b _{i + 1 '} b _i ) = (1,1)

The entire timestamp information is applied to the input of the TCC, respectively. The function output (b _{i + 1 '} b _i ) (i = 0 to 15 is an even number) outputs a binary value according to the change of the time stamp before the instruction execution and after the execution of the instruction. The actual output values according to the commands in the file are as follows.

Generate = [Fn (0,1), (0,1) (0,1) (0,1)] [Si (0,1), (0,1), )]

Copy = [Fn (0,1), (0,1) (0,1) (0,1)] [Si (0,1), (1,0), (0,1), )]

Update = [Fn (0,0), (0,0) (0,0) (0,0)] [Si (0,0), (0,1), (0,1), )]

(In the drive) = [Fn (0,0), (0,0) (0,0) (0,0)] [Si (0,0), (0,1) (0,0)]

(0,1) (0,1) (0,1)] [Si (1,0), (1,1), (0,1) (0,1)]

Overwrite (leave source file) = [Fn (0,0), (0,0) (0,0) (0,0)] [Si (0,0), (1,0) ), (0,0)]

Overwrite (delete source file) = [Fn (0,0), (0,0) (0,0) (0,0)] [Si (1,0), (1,0) ), (0,0)]

File name change = [Fn (1,1), (1,1) (1,1) (1,1)] [Si (0,0), (0,0), (0,1) 0)]

Change file attributes = [Fn (0,0), (0,0) (0,0) (0,0)] [Si (0,0), (0,0), (0,1), ,0)]

Finally, the forensic discrimination module 30 calculates a binary code, converts it into a decimal code, and outputs it as a decoded character code assigned to the decimal code. That is, binary codes arranged in plural are converted into a single decimal code by decimal calculation, and a command code is assigned to the converted decimal code to automatically output the character code of the command name.

In the command name, the generation of the file in the character code is 21845, the copying of the file is 21861, the updating of the file is 20, the movement of the file within the drive is 65284, the movement of the file outside the drive is 21925, the overwriting of the file is overwritten by 36, Source overwrite overwrite is 164, file name change is 65284, and file attribute change is 4. In order to change to the command name character code, the converted command code is decoded into a 3-digit value. For example, the 21845 command code is assigned as 001, and the allocated code is coded so that the character code of the command name 'file creation' is output. Here, the same 65284 command code is output for moving the file in the drive and changing the file name. In principle, two commands internally perform the same operation.

Hereinafter, it will be understood that a practical discrimination effect of the security system of the present invention is effective by examining specific embodiments.

<< Experimental environment >>

Operating System: Windows 7 Ultimate K Service Pack 1

Disk Format: NTFS v3.1

Storage medium: SSD external usb drive

Storage space: 1TB

Disk allocation Cluster size: 4,096 bytes

Work directory name: d: \ WorkingDir, d: \ SrcDir

<File creation>

On Windows 7, create a new text file in the WorkingDir directory on your d: drive. In the Explorer window, click the right mouse button and select "New - Text Document" menu to create the file. This file is an empty file that does not contain any content. If the contents are recorded in this file, a command to modify contents is additionally executed after the generation command. It should also be noted that if you rename the file after creating it as "new text document.txt", then the file name change is additionally performed.

<Time stamp information collection>

Generated file name: New text document .txt

Working directory: d: \ WorkingDir

Operation date: 2015-06-30 10:33:07

Timestamp of post-production file:

New text document .txt

- $ STANDARD_INFORMATION ($ SI)

C: 2015-06-30 10:33:07 W: 2015-06-30 10:33:07

E: 2015-06-30 10:33:07 A: 2015-06-30 10:33:07

- $ FILE_NAME ($ FN)

C: 2015-06-30 10:33:07 W: 2015-06-30 10:33:07

E: 2015-06-30 10:33:07 A: 2015-06-30 10:33:07

The above timestamp is stored in the MFT entry. The "a" part shows the four timestamps of the $ STANDARD_ INFORMATION attribute, and the "b" part shows the four timestamps of the $ FILE_NAME attribute.

<Experimental Results>

Each timestamp consists of 8 bytes of hexadecimal, which uses the Windows 64-bit FILE TIME format. It is displayed from January 1, 1601, and can be displayed in units of 100 ns. Apply input timestamp to TCC & CC. Here, since generation of a file does not have a time stamp prior to the instruction, only the current time stamp after the instruction is input as a function input.

When the output of the forensic decoder and the given time stamp are applied to the forensic distinction function, it is determined as "file generation ".

It will be apparent to those skilled in the art that various modifications and variations can be made in the present invention without departing from the spirit and scope of the invention as defined by the appended claims. It is therefore intended that such variations and modifications fall within the scope of the appended claims.

10: Acquisition module 20: Transformation module
30: Forensic discrimination module

Claims (4)

What is claimed is: 1. An automated digital forensic system for determining a command history of a file using a log file recorded in accordance with a file command in a Windows file system, the system comprising:
The time stamp before the execution of the file command and the information of the time stamp after the execution of the file command are stored in the standard information property group and the standard information property group, A collection module for extracting a name attribute group;
The information extracted from the time stamp is compared with each other before and after the file command to calculate the time stamp change pattern distinguished by the non-change, the command execution time, the time information of the target file, and the standard information attribute time information of the target file, A conversion module for outputting the output signal; And
And a forensic discrimination module for calculating a binary code output according to the change pattern, converting the binary code into a single decimal code, assigning an instruction code to the converted decimal code, and outputting the instruction code. Automated digital forensic systems to determine. delete delete delete

Images