KR102294926B1 - Automated system for forming analyzed data by extracting original data - Google Patents

Abstract

The present invention provides a connection detection unit that, when electrically connected to the original storage, detects an electrical connection state with the original storage through transmission and reception of electrical signals to and from the original storage; a loading unit that reads target data to be copied from the original storage when the connection detection unit detects the connection state; an imaging unit that copies the target data in the form of an image file when the loading unit reads the target data; an analyzing unit that analyzes the image file imaged by the imaging unit based on the predetermined analysis listing information; and a data forming unit configured to extract and form the analysis data after analysis based on the predetermined analysis listing information.

Description

Automated system for forming analyzed data by extracting original data}

The present invention relates to a system for automatically forming analysis data through automatic extraction of original data, and more specifically, automatically extracts target data required for analysis from an original storage to a target storage, copies them in the form of an image file, and automatically It is a technical field related to systems that analyze and form data.

As the information society is advanced due to the development of IT technology, the use of electronic documents using smartphones, tablets, PCs, etc. is increasing.

Electronic documents created through a computer are very easy to copy and edit, and deleting large amounts of records can be done with a single mouse click. In addition, the electronic document has a characteristic that when a file is copied from a computer to another location, the copy file and the original file appear as the same file with no difference in content.

However, as the technology of electronic documents is advanced, related crimes have increased, and as the case of storing important clues in digital information devices including computers increases in general crime as well, professional digital forensic technology for evidence collection and analysis this is being requested

Digital forensics is a new field of security services that identifies and proves the facts of an action that occurred using the information device as a medium based on the digital data embedded in the information device.

Digital forensics is very useful for criminal investigations, civil disputes, and infringement accidents. Recently, the trend of being introduced to information audits in companies and activities to prevent industrial technology leakage is spreading. In order to prevent industrial technology leakage, the introduction of digital forensics-related technologies within companies is recommended as a means of academic journalism for digital evidence. For example, forensic technology can be used to strengthen internal security such as collecting legal evidence for insurance fraud and internet banking damage compensation, preventing internal information leakage, and auditing.

Digital forensics usually follows procedures such as obtaining, storing and transferring evidence, analyzing and investigating, and creating a report. Evidence acquisition is the process of collecting digital evidence at the scene of an incident. Storage and transfer is the stage of making images of digital evidence by transferring evidence to the analysis room, and it is a preparation procedure for analysis and investigation. Analysis and investigation recovers data used as evidence and analyzes digital data using various forensic analysis techniques such as file search, decryption, hash analysis, and signature analysis. Lastly, in the report preparation procedure, the results of analysis and investigation from the point of view of experts in digital evidence are explained in an easy-to-understand manner to the general public and submitted to courts.

In addition, in order for digital records to be used as evidence, various devices are used to eliminate the possibility of forgery and falsification in the entire digital forensic process, including the acquisition process and analysis process, and various methods are used to prove that the evidence is not tampered with.

As an example of a related prior patent document, "Digital Evidence Analysis System and its Method" (Registration No. 10-1288034, hereinafter referred to as Patent Document 1)" exists.

In the invention according to Patent Document 1, a digital evidence analysis system is a first network that performs user authentication on a user terminal connected to a work management system, a user connected to an analysis network for analysis of digital evidence files secured during digital forensics By individually allocating a VLAN (Virtual LAN) ID to the second network where the terminal accesses the digital evidence analysis system, and the user terminal connected to the analysis network, an independent virtual desktop corresponding to the assigned VLAN ID is created. and a third network provided to the user terminal. Through this configuration, the present invention divides the access area (network network) of the digital evidence analysis system into a public network and a private network. It is characterized in that it has the effect of improving security by providing it.

As another disclosed prior patent document, "an apparatus and method for collecting digital forensic-based digital data" (Registration No. 10-1870670, hereinafter referred to as Patent Document 2)" exists.

The invention according to Patent Document 2 discloses an apparatus and method for collecting digital data based on digital forensics. According to an embodiment of the present invention, a digital forensic-based data collection device includes an evidence collection unit configured to collect evidence data from the controlled collection target device by controlling the operation of the collection target device, and the controlled collection target device is the controlled device. a display unit configured to display a first image displayed on the screen of the controlled collection target device based on an operation, and an image capture unit configured to capture a second image related to a surrounding environment of the controlled collection target device; An image generating unit generating image data by combining at least one of the displayed first image, the photographed second image, and the third image, and a hash calculation unit calculating a first hash value for the generated image data , a user data generator generating user data by combining the calculated first hash value with image information of the image data, and a container file for storing a container file including the generated image data and the generated user data It is characterized in that it includes a storage unit.

In the case of Patent Document 1 and Patent Document 2, technical ideas for digital forensic-based evidence data collection and analysis are disclosed.

However, in the case of the technology of Patent Document 1, it includes the first network, the second network, and the third network and separates the access area according to each network, so it is a digital evidence analysis system with a complex form, and The technical idea of analysis is insufficient.

In the case of Patent Document 2, it relates to an apparatus and method for setting an environment for collecting digital forensic-based digital data and managing the collected digital data together, focusing on a device for collecting digital forensic-based data. There is no technical idea for a series of processes of duplicating and analyzing digital data.

Registration No. 10-1288034 Registration No. 10-1870670

The system for automatically forming analysis data through automatic extraction of original data according to the present invention has been devised to solve the conventional problems as described above, and presents the following problems to be solved.

First, in the process of obtaining digital evidence, we want to shorten the analysis time by connecting the device to the equipment in the field and performing basic analysis without loss of original data.

Second, we want to create analysis listing information in advance by selecting the priority of data required for analysis, and perform efficient analysis based on this.

Third, data required for digital evidence is automatically extracted and duplicated through transmission and reception of electrical signals with the original storage, and data is automatically analyzed and formed.

The problems to be solved of the present invention are not limited to those mentioned above, and other problems not mentioned will be clearly understood by those skilled in the art from the following description.

The system for automatically forming analysis data through automatic extraction of original data according to the present invention has the following problem solving means for the problems to be solved above.

In the case of the automatic analysis data formation system through automatic extraction of original data according to the present invention, when electrically connected to the original storage, the connection to detect the electrical connection state with the original storage through transmission and reception of electrical signals to and from the original storage sensing unit; a loading unit that reads target data to be copied from the original storage when the connection detection unit detects the connection state; an imaging unit that copies the target data in the form of an image file when the loading unit reads the target data; an analyzing unit that analyzes the image file imaged by the imaging unit based on predetermined analysis listing information; And after analysis based on the predetermined analysis listing information, it may be characterized in that it comprises a data forming unit for extracting and forming the analysis data.

In the case of the system for automatically forming analysis data through automatic extraction of original data according to the present invention, the connection detection unit alternately transmits and receives the electrical signal through two or more electrically connected wires with the original storage, By discontinuously detecting the electrical connection state, it may be characterized in that the electrical connection state is continuously checked.

In the case of the system for automatically forming analysis data through automatic extraction of original data according to the present invention, the imaging unit uses the target data of the original storage as a hash function as a medium, maps it to a hash table, and maps any one of the target data to a hash table. When there is a call of data, it may be characterized in that it includes a data hashing unit for reading the one data called through the hash function assigned to the one data as a medium.

In the case of the automatic analysis data formation system through automatic extraction of original data according to the present invention, the analyzing unit is configured to track trace information of an OS (Operating System) that drives the original storage to the predetermined analysis listing information. It may be characterized by including an OS trace analysis unit to be nested.

In the case of the system for automatically forming analysis data through automatic extraction of original data according to the present invention, the OS trace information includes the OS name, the OS ID, the OS ID owner, the affiliation of the OS IS owner, the OS version, The name of the PC (Personal Computer) in which the OS is installed, the start time of the OS, the end time of the OS, network connection information through the OS, the power saving mode on-off time of the OS, and the OS password (Password) may be characterized in that it includes at least one or more from a group consisting of.

In the case of the system for automatically forming analysis data through automatic extraction of original data according to the present invention, the analyzing unit tracks trace information of connection information with an electrically connected external storage of the terminal equipped with the original storage. It may be characterized in that it comprises an external connection analysis unit to be nested in the predetermined analysis listing information.

In the case of the system for automatically forming analysis data through automatic extraction of original data according to the present invention, the trace information includes the connection start time of the external storage, the connection end time of the external storage, ID information of the external storage, and the external storage It may be characterized in that it includes at least one or more from a group consisting of information transmitted to and copied from and information transmitted from the external storage.

In the case of the system for automatically forming analysis data through automatic extraction of original data according to the present invention, the analyzing unit is configured to track trace information of the use history of a web browser driven in a terminal equipped with the original storage device. It may be characterized in that it includes a web browser analysis unit to be nested in the analysis listing information.

In the case of the automatic analysis data formation system through automatic extraction of original data according to the present invention, the analyzing unit analyzes the trace information of file use under the OS system of the terminal equipped with the original storage, the predetermined analysis listing It may be characterized by including a file system analysis unit to be embedded in the information.

In the case of the automatic analysis data formation system through automatic extraction of original data according to the present invention, the trace information is a group consisting of creation information of the file, deletion information of the file, copy information of the file, and correction information of the file It may be characterized in that it comprises at least one or more from.

In the case of the system for automatically forming analysis data through automatic extraction of original data according to the present invention, the analyzing unit may store trace information of the leakage of the target data as a shortcut file under the OS of the terminal equipped with the original storage. It may be characterized in that it comprises a link record analysis unit to include the analysis in the predetermined analysis listing information.

In the case of the system for automatically forming analysis data through automatic extraction of original data according to the present invention, the analyzing unit includes: Trace information of metadata of a document file, a photo file, or an image file in the OS system of a terminal equipped with the original storage It may be characterized in that it comprises a metadata analysis unit to include the analysis of the predetermined analysis listing information.

In the case of the system for automatically forming analysis data through automatic extraction of original data according to the present invention, the analyzing unit may, through a file search program in the OS system of the terminal equipped with the original storage, determine the size of a folder, a folder view mode, It may be characterized by comprising a shellback record analysis unit that includes in the predetermined analysis listing information to analyze the location of the folder icon, a set of registry keys for folder management and maintenance, and trace information of the access record of the folder.

In the case of the automatic analysis data formation system through automatic extraction of original data according to the present invention, the analysis data is formed by arranging the trace information in the order of time, and the analysis data is converted to an Excel file extension, a CSV file extension, or It may be characterized in that it further comprises a timeline alignment unit to have a TXT extension.

The system for automatically forming analysis data through automatic extraction of original data according to the present invention configured as described above provides the following effects.

First, it is possible to analyze the original data stored in the original storage through transmission and reception of electrical signals and automatically extract the target storage from the original storage.

Second, the original data is automatically copied and imaged by reading the automatically extracted data to obtain the originality of the evidence without damage to the data, and to secure the integrity of the data through the hashing function.

Third, based on the imaged data, the predetermined analysis listing information, it is possible to automatically analyze and form the trace information of the data.

Effects of the present invention are not limited to those mentioned above, and other effects not mentioned will be clearly understood by those skilled in the art from the following description.

1 is a conceptual diagram illustrating transmission and reception of target data to be copied from an original storage to a target storage by an electrical signal according to an embodiment of the present invention.
2 is a block diagram of a central control unit of a system for automatically forming analysis data through automatic extraction of original data according to an embodiment of the present invention.
3 is a block diagram of an analyzing unit of a system for automatically forming analysis data through automatic extraction of original data according to an embodiment of the present invention.
4 is a conceptual diagram of an OS trace analysis unit for embedding in predetermined analysis listing information to track trace information of the OS according to an embodiment of the present invention.
5 is a conceptual diagram of an external access analysis unit that includes tracking trace information of access information with an external storage in predetermined analysis listing information according to an embodiment of the present invention.
6 is a conceptual diagram of a web browser analysis unit that includes tracking information on a usage history trace of a web browser in predetermined analysis listing information according to an embodiment of the present invention.
7 is a conceptual diagram of a file system analysis unit that includes analysis of trace information of file use under an OS system according to an embodiment of the present invention in predetermined analysis listing information.
8 is a view showing the size of a folder, a view mode of a folder, a location of a folder icon, a set of registry keys for managing and maintaining a folder, and an access record of a folder through a file search program in an OS system according to an embodiment of the present invention; It is a conceptual diagram of a shellback record analysis unit that includes analysis of trace information in predetermined analysis listing information.
9 is a conceptual diagram of a timeline sorting unit that forms analysis data by arranging trace information in order of time according to an embodiment of the present invention, and includes the analysis data according to an extension.

The system for automatically forming analysis data through automatic extraction of original data according to the present invention can apply various changes and can have various embodiments, and specific embodiments will be illustrated in the drawings and described in detail in the detailed description. However, this is not intended to limit the present invention to a specific embodiment, it should be understood to include all modifications, equivalents and substitutes included in the spirit and scope of the present invention.

1 is a conceptual diagram illustrating transmission and reception of target data to be copied from an original storage to a target storage by an electrical signal according to an embodiment of the present invention. 2 is a block diagram of a central control unit of a system for automatically forming analysis data through automatic extraction of original data according to an embodiment of the present invention. 3 is a block diagram of an analyzing unit of a system for automatically forming analysis data through automatic extraction of original data according to an embodiment of the present invention. 4 is a conceptual diagram of an OS trace analysis unit for embedding in predetermined analysis listing information to track trace information of the OS according to an embodiment of the present invention. 5 is a conceptual diagram of an external access analysis unit that includes tracking trace information of access information with an external storage in predetermined analysis listing information according to an embodiment of the present invention. 6 is a conceptual diagram of a web browser analysis unit that includes tracking information on a usage history trace of a web browser in predetermined analysis listing information according to an embodiment of the present invention. 7 is a conceptual diagram of a file system analysis unit that includes analysis of trace information of file use under an OS system according to an embodiment of the present invention in predetermined analysis listing information. 8 is a view showing the size of a folder, a view mode of a folder, a location of a folder icon, a set of registry keys for managing and maintaining a folder, and an access record of a folder through a file search program in an OS system according to an embodiment of the present invention; It is a conceptual diagram of a shellback record analysis unit that includes analysis of trace information in predetermined analysis listing information. 9 is a conceptual diagram of a timeline sorting unit that forms analysis data by arranging trace information in order of time according to an embodiment of the present invention, and includes the analysis data according to an extension.

As shown in FIG. 1, the system for automatically forming analysis data through automatic extraction of original data according to the present invention transmits and receives target data to be copied from the original storage 10 to the target storage 20 by an electrical signal. .

Here, the source storage 10 and the target storage 20 include storage devices such as personal computers, laptops, servers, compact disks, USB and memory cards, mobile devices such as smartphones and digital cameras, and network devices such as hubs, switches, and routers. may apply to

As shown in FIG. 2, in the system for automatically forming analysis data through automatic extraction of original data according to the present invention, the central control unit 30 of the target storage 20 includes a connection detection unit 100, a loading unit 200, It includes an imaging unit 300 , an analyzing unit 400 , and a data forming unit 500 .

First, in the case of the connection detection unit 100 , when electrically connected to the original storage 10 , transmission and reception of electrical signals from the original storage 10 to the target storage 20 is performed, and the connection detection unit 100 is electrically connected to the connection detection unit 100 . The connection state is sensed, and the electrical signal is alternately transmitted and received through two or more electrically connected wires with the original storage 10, and at the same time, the electrical connection state is continuously checked and detected. At this time, the target storage 20 must have at least the same capacity or greater than the original storage 10 .

As shown in FIG. 2 , the loading unit 200 reads the target data to be copied from the original storage 10 when it receives the electrical signal from the connection detection unit 100 and senses the connection state. When loading data, the original storage 10 is set to read-only, and the target storage 20 is set to read and write.

As shown in FIG. 2 , the imaging unit 300 copies the target data in the form of a readable image file when the loading unit 200 reads the target data. When the evidence is extracted from the original storage 10 and immediately analyzed, the data on the original storage 10 is exposed to the risk of damage or change. The imaging unit 300 is a tool for cloning the original storage 10 to another disk of the same physical form or creating a mirror image file in order to prevent damage or alteration of the data in the original storage 10 . am. The imaging method is classified into a sector-to-sector copying method or a bitstream copying method.

The image unit includes a data hashing unit 310 that proves the integrity of the data, and the data hashing unit 310 uses the target data of the original storage 10 as a hash function as a medium, and maps it to a hash table, When a certain piece of data is called, it plays a role of reading the called certain piece of data through a hash function assigned to the certain piece of data as a medium. Here, the hash function is defined as a function that converts an arbitrary bit string into a bit string of a fixed length. The hash function is used to prove that the replica and the original are identical and is used to verify the integrity of the data. If a hash value for the original file is created and stored, the hash value of the duplicate is calculated and compared with the hash value of the original file to determine whether a change has been made. For example, if a specific document file is converted into a hash function, a unique hash value combined with a specific number and letter is generated. integrity can be judged.

As shown in FIG. 3 , the analyzing unit 400 analyzes the image file imaged by the imaging unit 300 based on predetermined analysis listing information.

At this time, since the predetermined analysis listing information has many types and amounts of data to be processed in the data analysis process, and different data to be investigated according to need, the amount of data to be analyzed is reduced by preselecting the data required for the investigation, and the amount of data to be analyzed is reduced and analyzed efficiently and quickly. makes it possible In general, data is divided into classification according to time information, classification of forged and tampered data, classification by application file, and classification method by owner, and detailed analysis is performed based on the classified results. .

As shown in FIG. 3 in the automatic analysis data formation system through automatic extraction of original data according to the present invention, the analyzing unit 400 includes an OS trace analysis unit 410, an external connection analysis unit 420, and a web It may include a browser analyzer 430 , a file system analyzer 440 , a link record analyzer 450 , a metadata analyzer 460 , and a shellback record analyzer 470 .

As shown in Figure 4, the OS trace analysis unit 410 is to include a predetermined analysis listing information to track the trace information of the OS (Operating System) driving the original storage (10). At this time, the OS trace information includes the name of the OS, OS ID, owner of OS ID, affiliation of OS ID owner, OS version, PC name, OS start time, OS end time, network connection information through OS, power saving of OS It consists of mode on-off time, OS password, etc.

OS trace information can be extracted and analyzed through the OS registry. The registry is a central, hierarchical database that stores the information necessary to configure a system for one or more users, applications, and hardware devices. , program, system information and settings are included. When a user changes control panel settings, file associations, system policies, or installed software, the changes are reflected and saved in the registry. The registry also provides Windows into the kernel's operating system, exposing runtime information such as performance counters and the hardware currently in use. Registry Hive files are located in the [SystemRoot] System32Config folder and can be viewed with a command such as regedit.

As shown in Figure 5, the external connection analysis unit 420 is a predetermined analysis listing information to track the trace information of the connection information with the electrically connected external storage of the terminal equipped with the original storage 10. will be nested At this time, the trace information is composed of the connection start time of the external storage, the connection end time of the external storage, ID information of the external storage, information transmitted to and copied from the external storage, information transmitted from the external storage, and the like. The trace information of the external connection can be analyzed through the Windows registry or event log. When a certain device or application program is used, the operating system or application program may leave a log, and this log can be important information for event analysis. As an example, in the USB usage log, the usage log of USBs connected to the USB port remains in the registry, so trace information can be investigated.

As shown in Fig. 6, the web browser analysis unit 430 is embedded in the predetermined analysis listing information to track the trace information of the use history of the web browser driven in the terminal equipped with the original storage 10. . The web browser analysis unit 430 analyzes web history, used browsers, behaviors, cookies, temporary Internet files, and the like to find out what the user has accessed to the web. By analyzing the user's Internet usage traces, it is possible to identify behavioral patterns such as the user's recent interests, hobbies, lifestyle, etc. , criminal complicity, and personal confidential information can be identified.

As shown in FIG. 7 , the file system analysis unit 440 analyzes the trace information of file use under the OS system of the terminal equipped with the original storage 10 to be included in the predetermined analysis listing information. The trace information of the file system analysis unit 440 includes file creation information, file deletion information, file copy information, and file modification information.

The link record analysis unit 450 is included in the predetermined analysis listing information to analyze the trace information of the outflow of the target data as a shortcut file under the system of the OS equipped with the original storage 10 . This makes it possible to check recently accessed documents or data leakage through storage devices using the path and meta information of the target file. In the link record analysis unit 450, the link file name, link file creation date and time, link file access date and time, link file modification date and time, original file creation date and time, original file access date and time, original file modification date and time, original file path, system name, You can analyze information such as volume serial and drive type.

The metadata analysis unit 460 is included in the predetermined analysis listing information to analyze the trace information of the metadata of a document file, a photo file, or an image file in the OS system in which the original storage 10 is mounted. The metadata analysis unit 460 analyzes the metadata of HWP, DOC, DOCX, XLS, XLSX, PDF, audio file name, access date and time, creation date and time, modification date and time, path, MD5, and SHA1. The analysis target file can be specified by directly inputting the extension in the analyzer.

As shown in FIG. 8 , the shellback record analysis unit 470 manages the size of the folder, the folder view mode, the location of the folder icon, and the folder management through the file pale color program in the OS system of the terminal equipped with the original storage 10 . And a registry key set for maintenance, analyzing the trace information of the access record of the folder is implied in the predetermined analysis listing information.

The user records folder information accessed from local, network and removable storage devices in the shellback registry. Shellback information consists of two main registry keys, Bags and BagMRU. The BagMRU key creates a similar tree structure to store folder names and record folder paths, and the Bags key stores view preferences such as window size, location, and view mode. do.

As shown in Figure 2 in the automatic analysis data formation system through automatic extraction of original data according to the present invention, the data forming unit 500 analyzes based on predetermined analysis listing information, and then extracts necessary analysis data and to form The formed analysis result data can be output in a readable format that can be easily understood by not only experts but also the general public.

As shown in FIG. 9 , the timeline sorting unit 600 aligns the trace information in the order of time to form analysis data, and the analysis data is provided with the extension of an Excel file, an extension of a CSV file, or an extension of a TXT file let it do File systems have information on when each file was created, last accessed, and last modified. Based on the time information in the timeline sorting unit 600, it is easy to understand which files are created and accessed according to the passage of time, so that more effective data analysis can be performed.

By sorting by time information, you can examine the traces of computer usage at the time of the incident or the surrounding time zone to select and investigate the contents of the user's work. The presence or absence of files related to actions can also be analyzed using keyword search.

In addition, by classifying files in a specific time period, the system log data and application log check the presence or absence of investigation-related events within a specific time frame, and the access and change times of files based on the time period before and after a specific point in time when the incident occurred. It can also be researched and analyzed.

The scope of the present invention is determined by the matters described in the claims, and parentheses used in the claims are not described for selective limitation, but are used for clear components, and descriptions in parentheses are also interpreted as essential components. should be

10: source repository 20: target repository
30: central control unit 40: browsing display
100: connection detection unit 200: loading unit
300: imaging unit 310: data hashing unit
400: analyzing unit 410: OS trace analysis unit
420: external access analysis unit 430: web browser analysis unit
440: file system analysis unit 450: link record analysis unit
460: metadata analysis unit 470: shellback record analysis unit
500: data forming unit 600: timeline alignment unit

Claims (14)

a connection detection unit that, when electrically connected to the original storage, detects an electrical connection state with the original storage through transmission and reception of electrical signals to and from the original storage;
a loading unit that reads target data to be copied from the original storage when the connection detection unit detects the connection state;
an imaging unit that copies the target data in the form of an image file when the loading unit reads the target data;
an analyzing unit that analyzes the image file imaged by the imaging unit based on predetermined analysis listing information; and
After analyzing based on the predetermined analysis listing information, comprising a data forming unit for extracting and forming analysis data,
The connection detection unit,
By alternately transmitting and receiving the electrical signal through two or more electrically connected conductors with the original storage, the electrical connection state is detected discontinuously, and the electrical connection state is continuously checked,
The imaging unit,
The target data of the original storage is mapped to a hash table using the hash function as a medium, and when there is a call to any one data of the target data, the any one is called through the hash function assigned to the one data Includes a data hashing unit to read data,
The analyzing unit is
and a link record analysis unit for analyzing the trace information of the outflow of the target data as a shortcut file under the OS of the terminal equipped with the original storage in the predetermined analysis listing information,
The link record analysis unit,
The name of the link file, the creation date and time of the link file, the access date and time of the link file, the modification date and time of the link file, the creation date and time of the original file, the access date and time of the original file, the modification date and time of the original file, the modification date of the original file Analyze at least one or more of the path, system name, volume serial, or drive format to check recently accessed documents or data leaks,
The predetermined analysis listing information is,
Automatic extraction of original data, characterized in that the image file is preselected by selecting at least one classification method among i) classification of forged and forged data, ii) classification by application file, or iii) classification according to owner Analysis data through automatic formation system.
delete delete According to claim 1, wherein the analyzing unit,
Analysis data automatic formation system through automatic extraction of original data, characterized in that it comprises an OS trace analysis unit for embedding in the predetermined analysis listing information to track trace information of the OS (Operating System) that drives the original storage .
According to claim 4, wherein the trace information of the OS,
The OS name, the OS ID, the OS ID owner, the affiliation of the OS IS owner, the OS version, the name of the PC (Personal Computer) in which the OS is installed, the start time of the OS, the end time of the OS, the OS Analysis through automatic extraction of original data, characterized in that it includes at least one or more from a group consisting of network access information through the OS, power saving mode on-off time of the OS, and the OS password Data Auto Formation System.
According to claim 1, wherein the analyzing unit,
Automatic of the original data, characterized in that it comprises an external connection analysis unit for tracing trace information of connection information with an electrically connected external storage of the terminal equipped with the original storage in the predetermined analysis listing information. Analysis data automatic formation system through extraction.
According to claim 6, The trace information,
At least one or more from the group consisting of the connection start time of the external storage, the connection end time of the external storage, the ID information of the external storage, information transmitted and copied to the external storage, and information transmitted from the external storage Characterized in that, analysis data automatic formation system through automatic extraction of original data.
According to claim 1, wherein the analyzing unit,
Analysis through automatic extraction of original data, characterized in that it comprises a web browser analysis unit for embedding in the predetermined analysis listing information to track trace information of the history of use of a web browser driven in the terminal equipped with the original storage Data Auto Formation System.
According to claim 1, wherein the analyzing unit,
Automatic analysis data through automatic extraction of original data, characterized in that it comprises a file system analysis unit that analyzes the trace information of file use under the OS system of the terminal equipped with the original storage in the predetermined analysis listing information. formation system.
The method of claim 9, wherein the trace information,
Automatic analysis data formation system through automatic extraction of original data, characterized in that it comprises at least one from a group consisting of creation information of the file, deletion information of the file, copy information of the file, and correction information of the file .
delete According to claim 1, wherein the analyzing unit,
The original, characterized in that it comprises a metadata analysis unit to include in the predetermined analysis listing information to analyze the trace information of the metadata of a document file, a photo file or an image file in the OS system of the terminal equipped with the original storage, Analysis data automatic formation system through automatic extraction of data.
According to claim 1, wherein the analyzing unit,
Through the file search program in the OS system of the terminal equipped with the source storage, the size of the folder, the folder view mode, the location of the folder icon, the registry key set for managing and maintaining the folder, and trace information of the access record of the folder are analyzed. A system for automatically forming analysis data through automatic extraction of original data, characterized in that it comprises a shellback record analysis unit for encapsulating that in the predetermined analysis listing information.
The method of any one of claims 4, 5, 6, 7, 8, 9, 10, 12 or 13, wherein the automatic analysis data formation system comprises:
Forming the analysis data by arranging the trace information in the order of time, characterized in that it further comprises a timeline sorting unit for providing the analysis data with an Excel file extension, a CSV file extension, or a TXT extension, Analysis data automatic formation system through automatic extraction of original data.

Images