KR20140000369A - Forensic analysis method and system for document files - Google Patents

Abstract

The present invention relates to a forensic analysis method and a system for document files. The forensic analysis method comprises the following steps: a file receiving step receiving a file which is an object to be forensically analyzed; a file area checking step checking if there is a normal area or an unassigned area in the received file; a file searching step searching a compound document file in the normal or unassigned areas; a verifying step verifying the compound document file; and a data restoring step restoring data in the unassigned area of the compound document file. The forensic analysis method and system for document file can restore data stored in a damaged compound document file or an unassigned area of a damaged compound document file in which data is not assigned. [Reference numerals] (AA) Start; (BB) Receiving a file for performing forensic analysis; (CC) Mounted storage device; (DD) File/directory; (EE) Dump file in the unassigned area of a file; (FF) End; (S121) Kind of the file?; (S122) Analyzing a file system for determining into a normal area or the unassigned area; (S123) Received file is determined to be at the unassigned area; (S124) Received file is determined to be at the normal area; (S130) Searching a compound document file present in the normal area or unassigned area of the file; (S140) Validation for the searched compound document file is performed; (S150) Restoring of data in the unassigned area of the compound document file

Description

Forensic analysis method and system for document files

The present invention relates to a method and system for forensic analysis of a document file, and more particularly, to a method and system for forensic analysis of a document file for recovering data existing in some damaged areas of the document file.

As the industry develops, millions of documents are generated every day, and the documents are transmitted to other users around the world through various networks such as the Internet.

In particular, these documents are generated through various document generating programs. Among them, document files having a complex file binary format developed by Microsoft have data as a hierarchical structure similar to a kind of file system in a single file. It can be managed systematically, and it is mainly used in modern times that needs to store complex and diverse data.

In particular, when a document file using the compound file binary format (hereinafter referred to as a compound document file) is used for various crimes and becomes an important evidence or clue of an incident, digital forensics for analyzing the compound document file is used. ) Is being performed.

In order to perform the digital forensics, a compound document file is collected, analyzed, and also prepared in a case where a part of the compound document file is deleted, which is present in an unused area of the compound document file. Data must also be recovered.

However, it is difficult to analyze such compound document files, and in particular, to recover data existing in the unallocated area, which makes it difficult for the compound document file to play a decisive role as important evidence related to various crimes.

As described above, the prior art for the forensic analysis method and system of the document file is as follows.

Prior art 1 relates to Korean Patent Registration No. 0932537 (2009.12.9), which relates to a forensic evidence analysis system and method using an image filter. This prior art 1 creates a copy of the digital evidence, verifies that the original and the copy of the digital evidence are identical, archives the original of the digital evidence, and copies the digital evidence into an image filtering model generated by the learning model according to a defined category. By classifying image files into specific categories and analyzing the evidence to produce an evidence analysis result report, it is possible to quickly analyze all the image files contained in the hard disk and shorten the analysis time of the evidence.

In addition, the prior art 2, Korean Patent Registration No. 0882864 (2009.2.3), relates to a high-speed data retrieval system and method for a digital forensic system. This prior art 2, in a digital forensic system for analyzing digital evidence, configures a file system from a large disk image, rearranges clusters by file, converts files having text information in the disk image into text files, and Using a pattern matching board, you can quickly and accurately search for specific keywords or common expressions by bitwise search.

In order to solve the above problems of the prior art, the present invention is to provide a forensic analysis method and system for document files that can perform the recovery and analysis of data existing in the unallocated area of the compound document file.

Forensic analysis method of a document file according to an embodiment of the present invention for solving the above problems is a file receiving step of receiving a file to perform forensic analysis; A file area determination step of checking whether a normal area or an unassigned area exists in the received file; A file searching step of searching for a compound document file existing in a normal area or an unallocated area of the file; A verification step of performing verification on the compound document file; And a data recovery step of recovering data in the unallocated area of the compound document file.

More preferably, the method may include a file receiving step of receiving at least one of a storage device mounted on a medium to be examined, a dump file existing in an unallocated area of a file, a file, and a directory.

More preferably, when receiving a storage device mounted on the medium to be examined, the file system for the mounted storage device is analyzed and divided into a normal area in which data is stored or an unallocated area in which data is not stored. A first judging process for judging; A second determination step of determining whether the received file is an unallocated area when receiving a dump file existing in the unallocated area of the file; And a third determining step of determining that the file or directory is a normal area when the file or directory is received. A file area determination step of performing at least one process may be included.

More preferably, the normal region file searching process of searching for a compound document file existing in the normal region; And an unassigned area file searching process for searching for the composite document file existing in the unallocated area.

More preferably, a signature retrieval process of retrieving whether a signature representing a compound document in the received file exists; A directory object checking step of checking whether the compound document file in which the signature is found includes a unique directory object; And a header verification process of verifying a document state in the compound document file by verifying a header of the compound document file. It may include a normal area file search process including a.

More preferably, a signature retrieval process of retrieving whether a signature representing a compound document exists by analyzing a header structure of the received file; A compression checking step of checking whether the compound document file is compressed according to a signature search position of the compound document file in which the signature is found; A sector size checking step of analyzing a header structure of the compound document file to check the size of a sector used by the compound document file; A sector count checking step of checking the number of sectors allocated to a preset file allocation table; An extension file assignment table usage checking step of checking whether or not an extension file allocation table indicating information for managing the sector in which the file allocation table is stored is used; A file allocation table acquiring step of acquiring a file allocation table for all compound document files after interpreting the expansion file allocation table based on the start sector information of the expansion file allocation table when the extension file allocation table is used; And a file size calculation step of calculating a size of the compound document file based on the file allocation table. It may include an unallocated file search process including a.

More preferably, access verification step of verifying whether the access to the unique directory object included in the compound document file; And a normal determination process of determining whether the document state is normal or damaged by verifying a data structure of the compound document file.

More preferably, if it is determined that the compound document file is normal, the directory object information extraction process of extracting at least one of a stream, storage name, creation time, and modification time by collecting a directory object in binary format in the compound document file. ; A data extraction process of extracting text and metadata from the compound document file; A file name determination process of determining a name of the compound document file based on the text and metadata extracted from the compound document file; And an unallocated size calculation process of calculating a size of an unallocated region in the compound document file.

More preferably, the directory object recovery process of restoring a directory object in binary format for a damaged file of the compound document file or a file determined to be an unallocated area of a compound document file that has been verified as normal; A metadata recovery process for restoring metadata of the compound document file; A compression checking step of checking whether or not to compress and store the body stream of the compound document file; A text extraction process of extracting text through a text extraction algorithm of the body data of the compound document file after compression checking is completed; A remaining data extraction process of extracting remaining data except text from the compound document file; And a file recovery process for recovering the compound document file by combining the extracted text and the remaining data. It may include a data recovery step comprising a.

More preferably, when the body stream of the compound document file is compressed and stored, an uncompressed sector filtering process of filtering out uncompressed sectors among unallocated sectors in the compound document file; A first sector searching process of searching a first sector of the compressed sectors through a compression algorithm with respect to the compressed sectors of the compound document file; A compression sector combining process of combining the retrieved first compressed sector with the remaining compressed sectors of the compound document file; And decompressing the combined compression sector and acquiring the body data to obtain the body data.

The method and system for forensic analysis of a document file of the present invention have an effect of easily recovering a damaged compound document file or data stored in an unallocated area to which data in the compound document file is not allocated.

In addition, the forensic analysis method and system of the document file of the present invention has an effect of quickly solving various crimes through forensic analysis of the compound document file and recovery of the damaged compound document file.

1 is a diagram showing the internal structure of a compound document file.
2 is a flowchart illustrating a forensic analysis method of a document file according to an embodiment of the present invention.
3 is a flowchart illustrating a detailed process of a compound document file search step of the present invention.
4 is a table showing the internal structure of a header of a compound document file.
5 is a table showing the internal structure of the file allocation table.
6 is a table showing an example of a file allocation table.
7 is a flowchart illustrating a detailed process of the compound document file verification step of the present invention.
8 is a table showing the internal structure of a directory object.
9 is a diagram illustrating an example of a slack region of a stream.
FIG. 10 is a diagram illustrating an unallocated area and a slack area existing in the compound document file.
11 is a flowchart showing the detailed procedure of the data recovery step in the unallocated area of the compound document file of the present invention.
12 is a table showing the internal structure of an attribute stream.
13 is a diagram illustrating a recovery process of compressed body data.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT Hereinafter, the present invention will be described in detail with reference to preferred embodiments and accompanying drawings, which will be easily understood by those skilled in the art. The present invention may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein.

First, before describing the present invention, the internal structure of the compound document file will be described in detail.

1 is a diagram showing the internal structure of a compound document file.

As shown in FIG. 1, the compound document file used in the present invention has a hierarchical structure of storage and streams, and includes metadata used to manage the storage and streams.

Such storage does not have any data actually present therein, and acts like a directory of a file system, and may include a root storage and a sub storage belonging to a lower portion thereof.

In addition, the stream belongs to the lower part of the storage, and is divided into a standard stream and a small stream according to its size. When the stream size is 4096 bytes or more, it is called a standard stream, and when the stream is smaller than 4096 bytes, it is a small stream. have. In addition, the standard stream is configured with reference to a file allocation table (FAT), and the small stream is configured with reference to a small file allocation table (Mini FAT). In addition, such a stream is divided into a text stream, a data stream, and the like according to the contents contained therein.

In addition, the metadata is data for describing or managing data input by a user, and is automatically generated on an application program. Such metadata includes header sectors, file assignment tables, extended file assignment tables, and directory objects. The header sector is the highest 512 bytes of the compound document file and contains information necessary for accessing the storage or the stream. The file allocation table stores chain information of sectors, the extended file allocation table indicates information for managing sectors in which the file allocation table is stored, and the directory entity stores information stored in the storage and streams. have.

Table 1 below shows the difference between the file system (FAT, NTFS) used in the operating system and the compound document file of the present invention.

division File system Compound document file Metadata Boot sector Header sector Storage method Save file with cluster assignment Save stream with sector allocation Data unit cluster Sector, small sector Data format Directory, file Storage, stream Data type information MFT
Directory object Assignment Information Management File Allocation Table File Allocation Table Relationship Tree structure Tree structure Top-level repository Root directory Root storage Child repository Directory storage

Forensic analysis of the compound document file will be described in more detail with reference to FIG. 2.

2 is a flowchart illustrating a forensic analysis method of a document file according to an embodiment of the present invention.

As shown in FIG. 2, in the forensic analysis method of the document file of the present invention, the file receiving unit first receives a file to be subjected to forensic analysis (S110). In this case, various types of files to be subjected to forensic analysis may be received, and the types of files received for forensic analysis are checked (S121). For example, a storage device (e.g., hard disk, RAM, memory card, removable storage device, etc.) mounted on the medium to be investigated (e.g., computer, laptop, etc.) is inputted or data is not allocated. A dump file existing in the unallocated area may be received, or at least one of a general document file or a directory may be received as a file for forensic analysis.

In this case, when the file receiving unit receives a storage device mounted on a target medium for which forensic analysis is to be performed, the controller analyzes the file system in the storage device, and the normal area in which the data in the storage device is stored, and the data. Determine each of the unallocated areas that are not stored (S122).

Alternatively, when the file receiving unit receives a dump file existing in an unallocated area where data is not allocated, the control unit determines that the received file is an unallocated area (S123).

On the contrary, when the file receiving unit receives the general document file or the directory, the control unit determines that the data is a normal area in which data is stored (S124).

As described above, the control unit first grasps the type of file received for forensic analysis, divides the received file into a normal area or an unassigned area, and then combines the binary file in the normal or unallocated area. Check whether the document file exists (S130).

Hereinafter, the searching step of the compound document file will be described in more detail with reference to FIG. 3.

3 is a flowchart illustrating a detailed process of a compound document file search step of the present invention.

As shown in FIG. 3, it is checked whether the compound document file in the normal area or the compound document file in the unassigned area exists with respect to the reception file in which the determination of the normal area or the unassigned area is performed through step S120. (S131).

At this time, the detailed retrieval process differs depending on whether the compound document file exists in the normal area or the unassigned area.

First, in order to search for the existence of the compound document file in the normal region, the controller checks whether a signature representing the compound document in binary format exists for the data of all files existing in the normal region (S132).

In this case, when it is determined that a signature indicating a compound document exists among the data existing in the normal area of the received file, the unique data such as Microsoft Office, Korean, and computer Hangul are targeted to the data existing in the normal area of the received file. One directory object is checked (S133).

Through this checking process, when the controller determines that the signature indicating the compound document in the received file exists and includes a unique directory object, the controller determines that the compound document file in the normal area of the received file exists, The header of the file is verified (S134).

At this time, by checking whether the verification of the header of the compound document file is successful (S135), if the verification of the header of the compound document file is successful, it is determined that the existing compound document file is in a normal state (S136).

On the contrary, when the verification of the header of the compound document file fails, it is determined that the compound document file exists in the normal region of the received file, but the state of the existing compound document file is damaged (S137).

At this time, the signature indicating the compound document does not exist in the data present in the normal region of the file received in step S132, or the data present in the normal region of the file received in step S133 contains a unique directory object. If not, it is determined that the compound document file does not exist in the normal area of the currently received file, and the next file received by the file receiving unit (S138) is the normal area according to the received file type described in the above-described process S120 or The existence of the unassigned area is checked, and accordingly, the process of searching for the composite document file for each area described in step S130 is performed again.

Unlike the case in which the compound document file in the normal region of the received file exists, the case where the compound document file in the unallocated region of the received file exists will be described.

First, it is checked whether a signature representing a compound document exists based on the sector or cluster size in the unallocated area of the received file (S139a).

If it is determined that a signature indicating a compound document exists by the sector or cluster size in the unallocated area of the received file, it is determined that the compound document file exists in the unallocated area of the received file, It is checked whether the data is compressed (S139b). For example, if the signature (0xD0CF11E0A1B11AE1) is found at the third offset of the compound document file, the compound document file may be NTFS compressed data. Therefore, the normal compound document decompressed by performing NTFS decompression is performed. Obtain the data of the file.

In this way, after acquiring the data of the compound document file existing in the unallocated area, the process of calculating the size of the compound document file is performed.

4 is a table showing the internal structure of a header of a compound document file.

Then, as shown in FIG. 4, the size of the sector is checked through the header of the compound document file (S139c), and then the number of sectors is checked (S139d). For example, when the sector shift is 9, it can be seen that the size of the sector is 512, which is 2 ⁹ , and the value corresponding to the number of sectors in the header structure is 0x2C.

Thereafter, in order to obtain a file allocation table for each compound document file received by the file receiving unit, the control unit first checks whether the extended file allocation table is used (S139e). In this case, when the size of the compound document file is about 7 MB or more, an extended file allocation table indicating a separate table for managing a location where the file allocation table for the compound document file is stored may be used. In particular, as shown in FIG. If Number of DIFAT Sectors is greater than 0 in the header internal structure of compound document file, it can be determined that extended file allocation table is used.

Accordingly, the file allocation table for all of the received files is obtained by analyzing the extension file allocation table used by using the first sector information described in the expansion file allocation table (S139f).

In this way, the file receiving table calculates the size of the compound document file using the file allocation table for each file (S139g).

5 is a table showing the internal structure of the file allocation table.

As shown in FIG. 5, a chain of sectors in which stream data is stored may be configured using the file allocation table obtained through the process S139f. For example, when the file allocation table is configured as shown in FIG. 6, if the start index of a stream is 9, the sector chain is 9 → 10 → 11 → 12 → 13 → 14 → -2. In this case, since the index of the file allocation table indicates the position in the remaining portions except for the header of the file, the position in the file may be obtained by multiplying the size of the sector checked through the step S139c by adding 1 to the position of the index. have.

Position in file = (position of index + 1) × size of sector

Thereafter, the controller calculates the maximum value of the index existing in the file allocation table, adds 2 to the calculated maximum value, and multiplies the size of the sector checked through step S139c to calculate the size of the compound document file. In this case, adding 2 to the maximum value of the index is to include the header sector corresponding to index 0 and the last sector corresponding to the index maximum value.

File size = (maximum value in file allocation table + 2) × size of sector

As described above, the searched compound document file is verified (S140).

Hereinafter, the verification step of the compound document file will be described in more detail with reference to FIG. 7.

7 is a flowchart illustrating a detailed process of the compound document file verification step of the present invention.

As shown in FIG. 7, the control unit verifies whether access to a unique directory object such as Microsoft Office, Korean, and Korean of the computer included in the compound document file is possible (S141).

The data structure included in the compound document file accessible to the unique directory object is verified to determine whether the document state of the compound document file is normal or damaged (S142).

If the document state of the compound document file is normal (S143), the directory object in binary format in the compound document file is collected, and the stream, storage name, and generation are generated through the internal structure of the directory object shown in FIG. At least one information of time and modification time is extracted (S144).

In addition, the body and metadata are extracted from the compound document file (S145). In this case, since the body data is stored through a unique storage format such as Microsoft's office or Korean and a computer's Hangul, it is possible to obtain meaningful data such as text and images by interpreting the storage format of the body data. have. In addition, the metadata is data for describing or managing data input by a user through an attribute stream, and may acquire metadata, which is data automatically generated on an application program. This attribute stream is a special stream existing in the compound document file and stores attribute information about the document file. For example, Hangul and computer Hangul (after the 2000s) file stores attribute streams such as 0x0005HwpSummaryInformation and Microsoft's Office (1997-2003), 0x0005SummnaryInformation and 0x0005DocumentSummaryInformation. The attribute stream stores information such as title, subject, author, last saved person, creation date, and modification date related to the compound document file.

Thereafter, the controller may determine the name of the compound document file through the extracted body data and meta data (S146). The name of the compound document file may be determined by selecting one of the first part of the body text, the title or the subject recorded in the metadata, or the location of the sector or cluster where the data is found.

Subsequently, the size of the area which is not used in the compound document file, that is, the unallocated area is calculated (S147). Since the compound document file stores data based on a specific unit, an area where data is not stored, that is, an unallocated area and a slack area may exist. Hereinafter, an unallocated area and a slack area inside the compound document file will be described in detail with reference to FIGS. 9 to 10.

9 is a diagram illustrating an example of a slack region of a stream.

As shown in FIG. 9, when the size of the stream A is 4,246 bytes and it is assumed that data is stored in units of sectors, that is, 512 bytes, in order to store 4,246 bytes of data corresponding to the size of the stream A, a total of 9 It can be seen that four sectors are allocated. At this time, as data is stored up to 4,246 bytes, it can be seen that a slack region of 362 bytes is generated after subtracting 4,246 bytes from 4,608 bytes.

In addition, the unallocated area or slack area existing inside the compound document file is as follows.

FIG. 10 is a diagram illustrating an unallocated area and a slack area existing in the compound document file.

As shown in FIG. 10, it can be seen that the portion corresponding to the index having a value of 0xFFFFFFFF (-1) in the file allocation table corresponds to the unallocated region, and the last portion of the directory object or stream corresponds to the slack region. .

Such unallocated area or slack area (hereinafter, referred to as "unallocated area") may exist in the compound document file, and due to the characteristics of each application program, the previous work history may be stored in the unallocated area of the compound document file. It can also happen if it remains.

Therefore, when the data in the unallocated area of the compound document file exists, the existing data is recovered (S150).

Hereinafter, the data recovery step in the unallocated area of the compound document file will be described in detail with reference to FIG. 11.

11 is a flowchart showing the detailed procedure of the data recovery step in the unallocated area of the compound document file of the present invention.

As shown in FIG. 11, the control unit first checks whether the compound document file is a damaged file or a file in which data in the unallocated area exists (S151).

If the control unit determines that the compound document file is a damaged file or a file in which data in the unallocated area exists, the control unit recovers the directory object in binary format (S152). For example, as the name information, the creation time information, and the modification time information of the stream or storage existing in the compound document file are extracted and acquired, respectively, the directory object may be recovered by analyzing the extracted information.

Subsequently, the meta data of the compound document file is recovered (S153). That is, recovery of attribute stream of compound document file is performed.

12 is a table showing the internal structure of an attribute stream.

As shown in FIG. 12, a start sector of the attribute stream may be searched using information such as a byte order (0xFFFE), a CLSID, and an FMTID. As described above, after the controller searches for the start sector of the attribute stream, the controller analyzes the internal structure of the attribute stream and recovers each attribute information.

Thereafter, before restoring the body data of the compound document file, the case where the body data is compressed may occur, so it is checked whether the body stream of the compound document file is compressed (S154).

If the body stream of the compound document file is compressed, the uncompressed sector is filtered for an unallocated sector in the compound document file (S155). Through this filtering process, not only sectors composed of 0x00 or 0xFF, sectors composed only of characters such as ASCII or Unicode, but also data of low randomness due to uncompressing are excluded from the body data recovery target.

Thereafter, the first sector of the compressed sector of the compound document file is searched using a compression algorithm mainly used in a compression program (S156). In this way, after the searched first compressed sector is mutually combined with the remaining compressed sectors of the compound document file (S157), decompression is performed on the combined compressed sectors to obtain body data (S158).

13 is a diagram illustrating a recovery process of compressed body data.

As shown in FIG. 13, as a plurality of compressed body streams exist in the compound document file, the decompressed body data may be obtained by combining and decompressing the plurality of compressed sectors. have.

In this way, text is extracted from the body data of the compound document file based on a text extraction algorithm with respect to the decompressed body data or the uncompressed body stream of the compound document file (S159). Thereafter, the remaining data except for the text extracted through the process S159 is extracted (S159a).

In this way, the composite document file is finally restored by combining the text extracted through the process S159 and the remaining data extracted through the process S159a (S159b).

In addition, the forensic analysis method of the document file may be stored in a computer readable recording medium having recorded thereon a program for execution by a computer. At this time, the computer-readable recording medium includes all kinds of recording apparatuses in which data that can be read by a computer system is stored. Examples of the computer readable recording medium include ROM, RAM, CD-ROM, DVD 占 ROM, DVD-RAM, magnetic tape, floppy disk, hard disk, optical data storage, and the like. The computer readable recording medium can also be distributed over network coupled computer devices so that the computer readable code is stored and executed in a distributed fashion.

The method and system for forensic analysis of a document file of the present invention have an effect of easily recovering a damaged compound document file or data stored in an unallocated area to which data in the compound document file is not allocated.

In addition, the forensic analysis method and system of the document file of the present invention has an effect of quickly solving various crimes through forensic analysis of the compound document file and recovery of the damaged compound document file.

While the present invention has been described in connection with what is presently considered to be practical exemplary embodiments, it is to be understood that the invention is not limited to the disclosed embodiments, but, on the contrary, Do.

S110: Receive a file for forensic analysis
S120: Determine whether there is a normal area or an unallocated area in the file.
S130: Search for a compound document file existing in the normal or unallocated area of the file
S140: Validate compound document file
S150: Perform data recovery in unallocated area of compound document file

Claims (11)

A file receiving step of receiving a file to perform forensic analysis;
A file area determination step of checking whether a normal area or an unassigned area exists in the received file;
A file searching step of searching for a compound document file existing in a normal area or an unallocated area of the file;
A verification step of performing verification on the compound document file; And
A data recovery step of performing recovery of data in the unallocated area of the compound document file;
Forensic analysis method of the document file comprising a.
The method of claim 1,
The file receiving step
A forensic analysis method of a document file, characterized in that it receives at least one of a storage device mounted on a medium to be examined, a dump file existing in an unallocated area of a file, a file, and a directory.
3. The method of claim 2,
The file area determination step
When receiving a storage device mounted on the medium to be examined, a first system that analyzes a file system for the mounted storage device received and divides it into a normal area in which data is stored or an unallocated area in which data is not stored. Judgment process;
A second determination step of determining whether the received file is an unallocated area when receiving a dump file existing in the unallocated area of the file; And
A third determination step of determining that the file or directory is a normal area when the file or directory is received;
Forensic analysis method of the document file, characterized in that to perform at least one of the process.
The method of claim 1,
The file search step
A normal region file searching process for searching for a compound document file existing in the normal region; And
An unallocated area file searching process of searching for a compound document file existing in the unallocated area;
Forensic analysis method of the document file, characterized in that to perform one of the process.
5. The method of claim 4,
The normal region file search process
A signature retrieval process for retrieving whether a signature representing a compound document in the received file exists;
A directory object checking step of checking whether the compound document file in which the signature is found includes a unique directory object; And
A header verification process of verifying a document state in the compound document file by verifying a header of the compound document file;
Forensic analysis method of a document file comprising a.
5. The method of claim 4,
The unallocated file search process
A signature retrieval process of retrieving whether a signature representing a compound document exists by analyzing a header structure of the received file;
A compression checking step of checking whether the compound document file is compressed according to a signature search position of the compound document file in which the signature is found;
A sector size checking step of analyzing a header structure of the compound document file to check the size of a sector used by the compound document file;
A sector count checking step of checking the number of sectors allocated to a preset file allocation table;
An extension file assignment table usage checking step of checking whether or not an extension file allocation table indicating information for managing the sector in which the file allocation table is stored is used;
A file allocation table acquiring step of acquiring a file allocation table for all compound document files after interpreting the expansion file allocation table based on the start sector information of the expansion file allocation table when the extension file allocation table is used; And
A file size calculation step of calculating a size of the compound document file based on the file allocation table;
Forensic analysis method of a document file comprising a.
The method of claim 1,
The verification step is
An access verification process of verifying whether access to a unique directory object included in the compound document file is accessible; And
A normal determination process of verifying a normal or damaged state of a document by verifying a data structure of the compound document file;
Forensic analysis method of a document file comprising a.
The method of claim 7, wherein
The verification step is
If it is determined that the compound document file is normal, extracting directory object information in binary form in the compound document file to extract at least one of a stream, storage name, creation time, and modification time;
A data extraction process of extracting text and metadata from the compound document file;
A file name determination process of determining a name of the compound document file based on the text and metadata extracted from the compound document file; And
And a non-allocating size calculation step of calculating a size of the unallocated region in the compound document file.
The method of claim 1,
The data recovery step
A directory object recovery process of restoring a directory object in binary format for a damaged file among the compound document files or a file determined to be an unallocated region among the compound document files verified as normal;
A metadata recovery process for restoring metadata of the compound document file;
A compression checking step of checking whether or not to compress and store the body stream of the compound document file;
A text extraction process of extracting text through a text extraction algorithm of the body data of the compound document file of which compression checking is completed;
A remaining data extraction process of extracting remaining data except text from the compound document file; And
A file recovery process for recovering the compound document file by combining the extracted text and the remaining data;
Forensic analysis method of a document file comprising a.
10. The method of claim 9,
The compression check process is
An uncompressed sector filtering step of filtering uncompressed sectors among unallocated sectors in the compound document file when the body stream of the compound document file is compressed and stored;
A first sector searching process of searching a first sector of the compressed sectors through a compression algorithm with respect to the compressed sectors of the compound document file;
A compression sector combining process of combining the retrieved first compressed sector with the remaining compressed sectors of the compound document file; And
A body data acquisition process of acquiring body data after decompressing the combined compression sector;
Forensic analysis method of a document file comprising a.
A forensic analysis system of a document file according to any one of claims 1 to 10.

Images