WO2010002185A2

WO2010002185A2 - Method for automatically and completely deleting temporary files used in application programs

Info

Publication number: WO2010002185A2
Application number: PCT/KR2009/003577
Authority: WO
Inventors: 정익호; 이승호; 구진국
Original assignee: (주) 애니컴페니언
Priority date: 2008-07-03
Filing date: 2009-07-01
Publication date: 2010-01-07
Also published as: WO2010002185A3; KR100898968B1

Abstract

The present invention relates to a method for automatically and completely deleting temporary files used in application programs. An object of the present invention is to provide a method for automatically and completely deleting temporary files used in application programs, wherein the method traces, through a hook system, the positions of the temporary files used in a variety of programs, and overwrites the relevant temporary files multiple times and deletes the temporary files to make recovery impossible.

Description

How to Automatically Delete Temporary Files Used by Applications

The present invention relates to a method for automatic complete deletion of temporary files used in an application program.

Recently, programs have been developed with the tendency to provide various and complex functions for improving user convenience or a convenient and nice interface. However, this requires a lot of memory, and as the program capacity increases and the system load increases during operation, the processing speed may be slowed down. In order to prevent this problem, most recent programs, especially large programs that use complex functions such as Office-related programs, use temporary files for user convenience and quick operation.

A concrete example of the operation using such a temporary file is as follows. Office programs, such as MS Word, use temporary files that store the contents of the file before it is saved. The location where these temporary files are created is the location where the corresponding Office file is opened and is usually saved as a file with a .tmp extension named (for MS-Word) ~ WRL_00x.tmp. Figure 1 (A) shows the creation of such a temporary file, such temporary files are to be deleted at the time when the Office file is closed (close).

As shown in FIG. 1 (A), in the case of MS-Word, if a change occurs in a document content since a document is opened (that is, when a user edits the document content), a file called ~ WRL_001.tmp is generated. As the number of changes in the document content increases, temporary files are continuously created with ~ WRL_002.tmp, ~ WRL_003.tmp, and so on. Such temporary files remain inside the file system even if the document is completely deleted by the user. Since the files can be restored as they are, using the file recovery program, the information created by the user is transferred to the outside. It is very likely to be a spill. FIG. 1 (B) shows a result of examining deleted files of a file system using a file recovery program, and ~ WRL0001.tmp and ~ $ rnelthreads.doc shown in FIG. You can see the generated temporary files ~ WRL_001.tmp and ~ $ RNEL ~ 1.DOC are retrieved as they are. In this way, if you use the file recovery program to recover deleted files and open them with MS-Word, you can restore the file as it was created. Such temporary files also have the advantage that they can be very useful for recovering when a document file is closed without saving the work done due to sudden power cut or user error.

However, in recent years, the general use environment of these programs is greatly different from the past, and the risk of such a function is increasing. Conventionally, programs related to Office-related programs have been used almost exclusively on computers in the company, but recently, each individual needs to store the necessary data in a portable storage device such as a portable USB device, and can easily move the data using the computer in the company. In addition, it is possible to carry out work in travel destinations and customers. This convenient movement of data can be a big advantage in that it allows you to perform tasks anytime, anywhere, without being limited in the area of activity, but rather, as this suggests from the temporary file creation function described above, It is well known that information is very likely to be leaked.

Temporary files are created many times in other kinds of programs. As described above, an example of high possibility of leakage of personal information or confidential information is web mail operation. In the web mail operation method, each individual user accesses a mail server that actually manages mail through a browser such as Internet Explorer, and downloads and reads the mail contents of an individual stored in the mail server through the browser. At this time, the browser imports not only a local storage file but also a file or data stored externally, and displays the data. In this process, a lot of data is temporarily stored in a temporary folder. For example, based on Windows XP, by default C: \ Documents and Settings \ [user name] \ Local Settings \ Temporary Internet Files (the [username] section in the above path may be changed for each PC environment). It is a well-known fact that Internet folders, which are downloaded from a browser, are stored in the folder (which is basically "hidden"). When a web page is viewed through the Internet in a browser, when a user downloads a new file such as a document or image related to the web page each time the user connects or refreshes, the traffic increases and not only burdens the server, but also makes the page available on the client side. Each time you download new data, you waste time and resources. Therefore, the browser saves these temporary files in the proper path and reuses the data previously downloaded when viewing the page, enabling more efficient operation for both the server and the client. 2 (A) shows the temporary file folder used by Internet Explorer after checking mail through the web. The files such as mail_view_fram [1] .htm and mail_view_subject_frame [1] .htm are the files that contain the body and subject of the mail, respectively. These files are downloaded from IE and stored temporarily. These temporary files have different names for each mail site, but use a common name for each site. These files are sometimes deleted but are still stored.

However, as the Internet temporary files are stored in the local client, the possibility of personal information leakage also increases. More detailed description is as follows. When you check a particular mail on the web using a browser such as Internet Explorer, these files are saved in the Internet temporary file folder. If these temporary files are leaked, you don't need to analyze them, just load them into a browser window and pop them up to find out what's in the mail and what attachments you have. FIG. 2 (B) shows the contents directly recovered by recovering the mail or the deleted mail file stored in the temporary folder. As shown in the figure, all the details such as the contents contained in the mail and the subject were revived, so it is possible to immediately track what information was used by the person using the PC.

Of course, there is no conventional method for solving this problem with Web mail. For example, there is a method of deleting a corresponding file by an automatic script as the mail list page moves, but there is a known problem that the page is often changed quickly or not according to the Internet environment. Also, the method of encrypting and deleting is known, but the method of analyzing the encrypted contents can be easily decrypted by analyzing the scripts such as javascript files that are stored together in the temporary folder to find out the key value used. It is also well known.

In addition, such conventional methods ultimately merely 'delete' web mail-related temporary files. In any case, if the file is recovered through a file recovery program and the encrypted contents are analyzed, the contents of the mail may be confirmed. There is a problem that can be.

As described above, it is well known that personal or confidential information is highly likely to be leaked by temporary files created by a program such as an office or temporary files for the Internet stored in a web mail checking process through an internet browser.

More specifically, it is as follows. If you work around your PC as well as your personal PC, the documents you work on will remain on your external PC. In addition, as described above, temporary files related to documents when using an office program, temporary files for the Internet, etc. when checking a web mail also remain on the external PC. These documents may be left unsaved without being deleted from an external PC according to the operator's attention, and these documents themselves may be deleted by the working person, but as described above, temporary files may be stored in the file system. Often left on the image. In addition, even in the case of personal PCs, temporary files may remain on the file system even if they are deleted for security after working with sensitive documents.

In the case of these temporary files, users who are not good at computer use often do not know that such temporary files are created. Even if a user knows that temporary files are created, the file names of temporary files are often confused. It is difficult to know which one is a temporary file of your document, so you may not be able to delete it. Of course, even if all the temporary files are found and deleted, the files deleted by the general deletion procedure can be recovered by most file recovery programs as shown in FIG. 1 (B) or FIG. 2 (B). Therefore, it is more likely that a third party will recover and open a temporary file left on an external PC, or a third party will hack a personal PC and leak these temporary files, thereby increasing the risk of personal and confidential information leakage. .

Conventionally, various techniques have been disclosed to prevent the security safety from being broken by recovering a temporary file or a deleted file remaining in a file.

Korean Patent Laid-Open Publication No. 2005-0112463 ("Method for permanently erasing data of a recording medium", hereinafter, prior art 1) searches for a physical disk and a logical disk of a computer during a booting process of a computer, and selects a physical disk or a logical disk selected by a user. Disclosed is a technique for deleting data stored in the data, thereby facilitating an operation of deleting the data itself, and not restoring the deleted data.

In Korean Patent No. 0380824 ("Method for permanently deleting a file stored in a storage device of a computer and its recording medium", hereinafter, Prior Art 2), a method for permanently deleting a file stored in a storage device of a computer so that recovery is impossible. More particularly, the present invention relates to a method of applying a data recovery means to overwrite a recoverable file so as to completely delete it from a storage area storing data, and to a recording medium recording means for realizing the method. The technique is disclosed.

In the prior art 2, a data recovery program whose main function is to first find all recoverable files as a previous step for the complete deletion of files from the computer storage area is started (not displayed on the screen, but not physically). First retrieve and mark the recoverable files that have not been deleted. Subsequently, if a file to be deleted is completely deleted from the files disclosed in the file list, it is impossible to recover the file by overwriting an area in which the file is stored with an arbitrary character.

However, in the case of the prior art 1 and the prior art 2, the data must be manually selected by the user. As described above, it is very inconvenient for the user to find temporary files that are automatically generated in large quantities for each application. . (For example, if you look at Figure 5, you can see that as many as nine or more temporary files are created while editing a document when using Office programs or Hangul programs, and their paths are also not constant.) For unfamiliar users, you have no idea what naming conventions are created for an application, what its extension is, what kind of temporary files are created in which location, and so on. This increases the likelihood that the user will not be able to completely delete the temporary file (which must be completely deleted), and therefore will not be able to secure security. In addition, since the deleted files are not recoverable, the burden on the user side must be confident in their choice, and therefore, the possibility of not using the deleted program at all is very high. Of course, it is obvious that the ultimate goal, that is, the purpose of improving security safety, cannot be achieved.

As described above, the prior arts 1 and 2, which allow the user to directly select a file to be completely deleted, cannot solve the problems described above. As a result, temporary files created by the application can be easily deleted by ordinary users (for example, general office workers, students, etc.) who are not computer users. There has been a steady demand.

Accordingly, the present invention has been made to solve the problems of the prior art as described above, an object of the present invention to track the location of the temporary file used in various programs using a hook (hook) method, and the temporary file It provides a method for automatic complete deletion of temporary files used by an application program that makes it impossible to recover by multiple overwriting them.

The automatic complete deletion method of the temporary file used in the application of the present invention for achieving the above object is implemented in the form of a program executed by arithmetic processing means including a computer, a1) by the program Configuring a process table linked with the real-time monitoring whether a process of an application program is executed; a2) real-time tracing of the operation of the application program using the PID of the process when a process start of the application program is detected and placed in the process table; a3) hooking the deletion API execution process when a process of executing a deletion API function for deleting a temporary file is detected among the processes of the application program; a4) grasp the attributes, the size and the location of the temporary file by using variables of the delete API function, change the properties of the temporary file to be writable, and then in the area from the start position to the end position of the temporary file Overwriting at least one or more overwriting patterns by the size of the file; a5) calling the original delete API function to be executed when the pattern overwriting is completed in the temporary file; Characterized in that comprises a.

Or, implemented in the form of a program executed by arithmetic processing means including a computer, by real time monitoring whether the process of the application program is executed by configuring a process table linked to the timer b1) by the program; b2) if a process start of an application is detected and entered in a process table, using the PID of the process to trace in real time the operation of the application; b3) hooking the generated API execution process when a process of executing the generated API function for generating a temporary file is detected among the processes of the application program; b4) identifying attributes, sizes, and locations of temporary files using variables of the generation API function, and managing and storing all files generated by the generation API execution process; b5) if the process termination of the application is detected, tracking all temporary files except the original file among the management-listed files with reference to the stored management list; b6) overwriting at least one or more overwriting patterns corresponding to the size of the temporary file in an area from the start position to the end position of the temporary file after changing the attribute of the temporary file to be writable; b7) when the pattern is overwritten in the temporary file, deleting the overwritten temporary files and terminating the application program normally; Characterized in that comprises a.

At this time, the program performs an overwrite operation using a user input string pattern when overwriting, an overwrite operation using a random string pattern, or generates and overwrites a pattern for overwriting according to the DoD 5220 method. If the Peter Gutmann method is selected, the pattern for overwriting and overwriting are performed according to the Peter Gutmann method. In this case, when the overwrite is performed using the user input string pattern or the random string pattern, the program may repeatedly overwrite the number of times according to a user input or a predetermined number of times.

In addition, the program is stored in a portable storage device including a USB and is automatically or manually executed when the portable storage device is connected to the processing unit, p1) monitoring an application program (S101); p2) hooking and tracing a process of creating or deleting a file (S102); p3) if the hooked process is a file deletion process, completely deleting the temporary file to be deleted through the steps a4) to a5) (S104 to S105); p4) if the hooked process is a file generation process, managing listing the generated temporary file through the process of step b4) (S106 to S107); p5) detecting a removal request of the portable storage device (S108); p6) completely deleting the temporary file managed and listed in step p4) through the processes of steps b5) to b7) (S109); p7) Receiving whether or not to delete the log including the management list from the user (S110), if the deletion request is input by referring to the management list created in step p4 (S111a) to completely delete the management list file ( S111); p8) terminating the program (S112); Characterized in that comprises a.

Alternatively, the program is installed on the arithmetic processing means and executed automatically or manually with the start of the arithmetic processing means system, q1) monitoring an application program (S201); q2) hooking and tracing a process of creating or deleting a file (S202); q3) if the hooked process is a file deletion process, completely deleting the temporary file to be deleted through the steps a4) to a5) (S204 to S205); q4) if the hooked process is a file generation process, managing list of generated temporary files for each application through the process of step b4) (S206 to S207); q5) detecting an application termination request (S208); q6) completely deleting the temporary file managed by the application program in step q4) through the processes of steps b5) to b7) (S209); q7) Receiving whether the log including the management list for each application is deleted from the user (S210), and if a deletion request is input, referring to the management list for each application created in step q4) (S211a) for each application. Completely deleting the management list file (S211); Characterized in that comprises a.

According to the present invention, there is an effect that the user can completely delete files that are not consciously created, that is, temporary files that are automatically generated by an office program, an Internet browser, or the like. As such, by automatically deleting various document temporary files or Internet temporary files that may contain user's personal or confidential information, even if temporary files are found or leaked by hacking or use of third parties, they cannot be recovered. In addition, the security and security of personal and confidential information are greatly increased.

In particular, according to the present invention, the user can automatically delete such temporary files simply by issuing a simple command without any trouble, such as searching or restoring what temporary files have been created by the user. There is a great effect that the user convenience is maximized. By maximizing user convenience, the user can more frequently perform automatic complete deletion of the temporary file according to the present invention more intimately, thus further increasing the long-term security safety.

1 is a temporary file generated by MS Word and recovery results.

2 is a temporary file generated by using web mail and a recovery result.

3 is a flowchart of a method for automatic complete deletion of a temporary file in which a trace is made at the time a temporary file is deleted.

4 is a flowchart of a method for automatic complete deletion of a temporary file in which a trace is made at the time a temporary file is created.

5 shows DeleteFile hook results in various applications.

6 is a log of temporary automatic file deletion results in various applications.

7 is a result of recovering the temporary file completely deleted by the present invention.

8 is an operation flowchart when the program of the present invention is stored in a portable storage device.

9 is an operation flowchart when the program of the present invention is installed on the system.

Hereinafter, a method of automatically deleting a temporary file used in an application program according to the present invention having the above configuration will be described in detail with reference to the accompanying drawings.

The automatic complete deletion method of a temporary file used in an application program according to the present invention includes two steps, a step of tracing a temporary file generated by the use of a program, and a process of deleting the traced temporary file so that it cannot be recovered. Is made of. At this time, the tracking of the temporary file is made when the temporary file is deleted or when the temporary file is created. Thus, when the temporary file is deleted or created, the program deleting or creating the temporary file is monitored. Can be detected.

Briefly describes API hooks related to program monitoring. First of all, an API (Application Programming Interface) is an interface created to control functions provided by an operating system or a programming language for use in an application program. It is mainly used for file control, window control, image processing, and character. Provides an interface for control, etc. The API consists of more than 1000 functions that can be used to create windows and open files when creating applications in the operating system or languages such as C, C ++, Pascal, etc. There is a distinct difference between a graphical user interface and a command-line interface that directly interacts with the user. APIs have a language or message format that is used when an application communicates with a system program, such as an operating system or database management system, and the API is implemented by calling a function that provides a link to a specific subroutine for execution within the program. . Thus, an API has several program modules or routines that must already exist or be linked in order to perform the work requested by the function call. A good API provides all the building blocks, and the programmer simply needs to put them together to make program development easier. Although the API was created for programmers like this, programs that use the same API have similar interfaces, making it easier for users to learn how to use new programs.

Examples of such APIs include the Windows API, DirectX, OpenGL, and the single Unix specification, and all widely used programs are built on top of these APIs. In other words, programs running in the Windows environment are based on the Windows API, while programs running in the Unix environment are based on the UNIX API. The Win32 API, one of the Windows APIs, includes _hread, _hwrite,... , AbnormalTermination, AbortDoc,… More than 2000 functions are included, among which the basic API functions related to files are CreateFile, ReadFile, WriteFile, DeleteFile, and CloseFile. These functions have the ability to create, read, write, delete, or close files as their name implies, and many applications use these APIs to create, read, and… And close functions. In a simple example, if you create a text document using Notepad (NOTEPAD.EXE) in a Windows environment, you can launch Notepad and select File> New in Notepad. By calling the API CreateFile, you create a new file. Also, if you select [File]> [New Post] in Korean (HWP.EXE), HWP.EXE will also call CreateFile to create a new file. Of course, each variable of CreateFile function varies according to file type, but it is common to create and use a new file by calling CreateFile function. In this way, even if different applications are based on the same API functions, they provide a familiar and convenient environment for both the developers of the application and the users who use them. The list of these APIs and how to operate them are widely open to the public for each OS (Windows, Unix, etc.), and anyone who can handle the programming language can write a program that can operate on the OS.

An API hook like this means that when an application calls an API, it hooks the API call instruction to modify the content of the intercepted data or prevent the API from running. As described above, many applications are mostly made based on APIs provided by the corresponding OS depending on the operating system. Therefore, the API hooking method may be used regardless of the application.

In the present invention, a temporary file generated by an application program such as Office or IE is automatically deleted. At this time, by optimizing for each application program to create a program in the form of the add-in or plug-in (Add-in or Plug-in) of the application and by running it, it is of course possible to automatically delete the temporary file, In this case, there is a disadvantage that each add-in must be made according to each application. For example, an add-in for MS Word, an add-in for Microsoft Excel, an add-in for MS PowerPoint, and an add-in for Korean should be created separately. Therefore, the form of add-in may be convenient when using a single application, but it is very inconvenient for the developer, and the user also has to be inconvenient to install and execute different add-ins in each application.

Therefore, in the present invention, the temporary file is basically tracked using an API hook. 3 and 4 illustrate a flowchart of a method for automatically deleting a temporary file of the present invention. Hereinafter, the method of the present invention will be described in more detail with reference to the accompanying drawings. At this time, the method of the present invention is implemented in the form of a program executed by arithmetic processing means such as a computer, and therefore, it will be apparent that the main subject of all operations is a program implemented to execute the method of the present invention. In addition, in order to avoid confusion, a program implemented to execute the method of the present invention is hereinafter referred to as the 'program of the present invention', which generates temporary files such as MS-based programs such as MS Word / Excel / Powerpoint, Korean programs, IE, etc. Note that all other programs are called 'applications'.

3 is a flowchart of a method for automatically deleting a temporary file in which a temporary file is tracked when a temporary file is deleted.

The program of the present invention configures a process table linked with a timer to monitor in real time whether a process of an application program is executed. At this time, if a process of a target application (Office related program, HWP, IE, etc.) is detected and listed in the process table, the program of the present invention continues the operation of the application program using PID (program ID) of the process. Trace in real time.

As described above, in the case of Office-related programs, temporary files are created at the location of the document while the document is being edited, and all temporary files are automatically deleted when the document is closed. As such, when the temporary file is deleted, the program of the present invention monitors the process of the application and detects an execution process of a delete API function for deleting the temporary file. The program of the present invention hooks the delete API execution process. (hook) As described above, the file deletion in the Windows environment is performed by the DeleteFile function in the API, and the DeleteFile function may be hooked as shown in FIG. 3, and in the OS environment other than Windows, the file deletion function in the corresponding OS. Just hook

After hooking the deletion API function execution process among the processes of the application program as described above, the program of the present invention uses the variables of the deletion API function to determine the property, size and location of the temporary file. For example, the prototype of DeleteFile in the Windows API is BOOL DeleteFile (LPCTSTR lpFileName). In other words, the result of DeleteFile function is returned as BOOL (boolean type, true / false) type, LPCTSTR (immutable generic string) type, and has a variable named lpFileName indicating the path and location of the file. Here you can use the value of the variable for lpFileName to determine the location of the temporary file. In addition, as an example, there is a window API function that returns a file size, such as GetFileSize. If the API function suitable for the purpose is used properly, the attribute or size of the temporary file can be easily determined through the variable value.

The program of the present invention detects the properties, size and location of the temporary file in this way, and then performs overwriting for automatic complete deletion. Typically, these temporary files are hidden and may not be read or written by any user, depending on the settings in the application. Therefore, the program of the present invention first changes the attribute of the temporary file to be writable. Subsequently, the overwriting pattern corresponding to the size of the temporary file is overwritten one or more times in the area from the start position to the end position of the temporary file using the size and location values of the temporary file identified in the previous step. .

As such, when the pattern overwriting is completed in the temporary file, the program of the present invention calls and executes the original delete API function again. As a result of this process, the deleted temporary file is deleted as the overwrite pattern is overwritten, and thus the overwritten contents are recovered even if the overwrite pattern is restored, so that the contents of the original file cannot be recognized at all.

4 is a flowchart of a method for automatically deleting a temporary file in which a trace is made when a temporary file is generated. In FIG. 3, a complete deletion is performed in the step of deleting a temporary file. In this case, for an Office-related program, a copy of a document file (temporary file such as ~ WRL_001.tmp, etc.) may be closed when the document is edited or closed. Although automatically deleted, the link file (.LNK) that links these document files or other files used in addition are not deleted separately (i.e. because the delete API function is not called in the application), the method of FIG. You cannot delete all the same temporary files. Therefore, in the method of FIG. 4, by hooking the API file generation function of the temporary file, all temporary files generated by the application can be automatically and completely deleted.

Once similar to the method of FIG. 3, the program of the present invention constructs a process table in conjunction with a timer to monitor in real time whether a process of an application program is executed. At this time, if a process of a target application (Office related program, HWP, IE, etc.) is detected and listed in the process table, the program of the present invention continues the operation of the application program using PID (program ID) of the process. Trace in real time.

As mentioned above, Office-related programs can create temporary files, which are copies of the documents, in the location of the documents while editing documents, and also create temporary files, such as link files that link the documents. have. As such, when the temporary file is generated, the program of the present invention monitors the process of the application and detects an execution process of a generation API function for generating a temporary file. The program of the present invention hooks the generation API execution process. (hook) As described above, the file creation in the Windows environment is performed by the CreateFile function in the API, and as shown in FIG. 4, the CreateFile function is hooked. In the case of an OS environment other than Windows, the file creation function in the corresponding OS Just hook

After hooking the process of executing the generated API function as described above, the program of the present invention uses the variables of the generated API function to grasp the attributes, sizes, and positions of all the generated files. For example, the prototype of CreateFile in the Windows API is HANDLE CreateFile (LPCTSTR lpFileName, DWORD dwDesiredAccess, DWORD dwShareMode, LPSECURITY_ATTRIBUTES pSecurityAttributes, DWORD dwCreationDisposition, DWORD dwFlagsAndAttributes, HANDLE hTemplateFile). In a manner similar to that described with respect to the DeleteFile function in FIG. 3, each variable of the CreateFile function may be used to easily determine the property, size, location, etc. of the generated file.

The program of the present invention grasps the attributes, sizes, and positions of all the files generated in this way, and then stores and stores necessary variables (properties, sizes, positions, etc.) of all the files. Then, when detecting that the process of the application program is terminated, the program of the present invention defines all files except the original file among all the generated files as temporary files and performs a step of automatically deleting them completely. (The distinction between the original file and the temporary file can be easily performed by using a file name rule, a creation time point, etc.) That is, when the termination of the process of the application program is detected, the program of the present invention is referred to by referring to the stored management list. After tracking all the temporary files except the original file among the management-listed files, changing the attributes of the temporary file to be writable, and using the size and location values of the temporary files identified in the previous step, The overwriting pattern corresponding to the size of the temporary file is overwritten at least once in the area from the start position to the end position of the file.

As such, when the pattern overwriting is completed in the temporary file, the program of the present invention deletes the overwritten temporary files and then terminates the process of the application program normally. Herein, to terminate normally means a process of returning a handle taken by a hook of the program of the present invention to the application program, or completing interference with the process of the application program, which is the program of the present invention. In accordance with the specific design of the programming is not specifically described as easily implementable and changeable by those skilled in the art. As a result of this process, temporary files (e.g., temporary files as document copies such as ~ WRL_001.tmp in MS Word) deleted by the termination of the application program are deleted as overwritten patterns. In addition, temporary files (e.g., temporary files including link files such as document.LNK in MS Word) that are not deleted by the termination of the application program may also be deleted as an overwritten pattern for overwriting according to the present invention. do. Therefore, even if any type of temporary files are recovered, only files having contents overwritten by the program of the present invention are recovered, so that the original files and all contents related to the original files cannot be recognized at all.

The program of the present invention may use only one method selected from the method of FIG. 3 and the method of FIG. 4, or may use both the method of FIG. 3 and the method of FIG. 4. In addition, the program of the present invention can automatically output the temporary files, as described above, and then store the list of temporary files that have been completely deleted as a log and output them when the user desires.

FIG. 5 illustrates DeleteFile hook results of MS Word, MS Excel, MS PowerPoint, and Korean HWP applications sequentially from the top, and each of them will be described in detail below.

Figure 5 (A) is a screen configured to track the DeleteFile of the MS Word to output the file name in the calling routine, as shown, not only to create a temporary file as a copy of the original, but also to store in a temporary folder of the user and recently used documents Also create .LNK files, etc.

Figure 5 (B) is a screen configured to output the file name in the call routine to trace the DeleteFile of MS Excel, the .LNK file and the temporary files in the form of .TMP at the location of the document, which is also the contents of the recently used document is created. .

Figure 5 (C) is a screen configured to output the file name in the call routine by tracking DeleteFile of MS PowerPoint, in the case of PowerPoint, the temporary file folder (C: \ Documents and Settings \ [user name] \ Local Settings of the user) Create a temporary file in \ Temp \) and delete it when you exit.

5 (D) is a screen configured to output the file name in the call routine by tracking DeleteFile of the Korean HWP, it can be seen that quite a lot of files are used as a temporary file in the case of Hangul. In Korean, too, create a temporary file in the user's temporary file folder (C: \ Documents and Settings \ [user name] \ Local Settings \ Temp \) and delete it when exiting.

FIG. 6 shows the MS log (from FIG. 6 (A)) sequentially from the top, as a result of completely erasing the temporary files generated by various application programs as shown in FIG. 5 using the program of the present invention. ), MS Excel (FIG. 6B), MS PowerPoint (FIG. 6C), and Korean HWP (FIG. 6D) application related logs are shown.

7 shows the result of recovering a temporary file that has been completely deleted by the present invention. As shown, the program of the present invention overwrites the pattern for overwriting at the temporary file location and then deletes it, so that even if the temporary file is recovered and viewed, the contents of the original document are not known at all. In FIG. 7, the overwriting pattern is set as a '0' repetition string to show a simple example. However, the overwriting pattern may be anything, such as a random string pattern. In particular, it is possible to use the DoD 5220 method, the Peter Gutmann method, or the like, which is an algorithm for completely deleting files for security, to generate an overwrite pattern and perform an overwrite. In more detail, the program of the present invention allows a user to select an overwriting pattern or an overwriting algorithm. For example, when a random method is selected, the number of random strings according to a user input or preset by a program designer is set. Overwrite the number of times, and if the DoD 5220 method is selected, the pattern for overwriting is created and overwritten according to the DoD 5220 method.If the Peter Gutmann method is selected, the pattern for overwriting is created and overwritten according to the Peter Gutmann method. You can make it write. Of course, in addition to the method described above, the program designer may adopt and use an appropriate overwrite algorithm.

The program for automatically deleting a temporary file according to the present invention may be stored in a portable storage device including a USB and executed automatically or manually when the portable storage device is connected to the arithmetic processing means, or installed on the arithmetic processing means. (installed) may be executed automatically or manually with the start of the arithmetic processing unit system. The former method can be applied to a specific case, for example, when a user is working on a PC other than his or her personal work PC, such as on a business trip. It can be applied when working.

In addition, the automatic or manual execution will be described in more detail as follows.

In the former case, when the portable storage device such as USB is inserted into the PC, the program of the present invention may be automatically executed immediately, or after the portable storage device is inserted, the user may execute the program file of the present invention stored in the portable storage device. You can also find and run it yourself to get the job done. The implementation of autorun can be easily implemented in a batch file based on the same principle as autorun.exe, which is a program autoplaying program when a CD or DVD is inserted.

In the latter case, for example, by registering the program of the present invention in the [starting program] in the window, the window can be started and the program of the present invention can be automatically executed. Alternatively, after the start of the window, the user may find and execute the program execution file of the present invention stored in the system and directly execute the operation.

8 is an operational flowchart in the former case, i.e., when the program of the present invention is stored in a portable storage device.

First, when a portable storage device is inserted into a PC and the program of the present invention is automatically or manually executed, the program of the present invention monitors an application program executed by the arithmetic processing means (S101), and hooks a process of creating or deleting a file. Tracking (S102). This is consistent with the steps of [Application Monitoring> Application Tracking> Delete API Hook or Generate API Hook] in FIGS. 3 and 4 above.

If the hooked process is a file deletion process, the temporary file to be deleted is completely deleted by automatically deleting the temporary file by the deletion API hook described with reference to FIG. 3 (S104 to S105). Alternatively, if the hooked process is a file generation process, the generated temporary file is managed and cataloged through the method described in the process of automatically deleting the temporary file by the generation API hook described in FIG. 4 (S106 to S107).

While repeatedly performing this process, monitoring is continuously performed, and when the user detects that the removal request is sent to the arithmetic processing means to remove the portable storage device to terminate the monitoring (S108), the program of the present invention is as follows. The same process will terminate the program.

First, the temporary file managed by the file creation process hook is deleted through the automatic temporary file deletion process by the generation API hook described with reference to FIG. 4 (S109). Subsequently, the user receives whether to delete the log including the management list from the user (S110), when a deletion request is input, referring to the management list (S111a) after completely deleting the management list file (S111) to terminate the program. It becomes (S112).

9 is an operational flowchart in the latter case, i.e. when the program of the present invention is installed on the system. The method of FIG. 9 is very similar to the method of FIG. 8, but there are some other parts, such as starting point of operation.

First, when the program of the present invention is automatically executed with system startup or manually executed by the user after system startup, the program of the present invention monitors an application program executed in the arithmetic processing means (S201), and creates or deletes a file. Hook and track the process (S202). This is consistent with the steps of [Application Monitoring> Application Tracking> Delete API Hook or Generate API Hook] in FIGS. 3 and 4 above.

If the hooked process is a file deletion process, the temporary file to be deleted is completely deleted through automatic deletion of the temporary file by the deletion API hook described with reference to FIG. 3 (S204 to S205). Alternatively, if the hooked process is a file generation process, the generated temporary file is managed and cataloged through the method described in the process of automatically deleting the temporary file by the generation API hook described in FIG. 4 (S206 to S207). At this time, the management list is created for each application.

While repeatedly performing this process, monitoring is continuously performed, and when a request for termination of a certain application program being monitored by the program of the present invention is detected among various application programs running on the system (S208), the program of the present invention corresponds to the corresponding program. The cleanup phase of the temporary file deletion process for the application will be performed. Here, it will be described in more detail to perform this process for each application as follows. Specifically, for example, a user may perform tasks while simultaneously using MS Word and MS PowerPoint. At this time, if the MS PowerPoint task is completed first, all temporary files created by MS PowerPoint may be deleted. However, in the case of MS Word, the work has not been completed yet. Therefore, if you try to delete the temporary files created by MS Word, you may experience a system crash or at least the program may not operate normally due to a permission conflict or memory leak between programs. The problem is likely to occur. In addition, such temporary files can be very useful for restoring the work process when the document is closed without saving the work due to an unexpected termination such as a power failure. It is not advisable to perform a complete deletion of them. Therefore, it is desirable to completely delete temporary files for each application.

Returning to the description of the method of FIG. 9 again. When the end of the application program is detected (S208), the program of the present invention performs a process of automatically deleting the temporary file by the generation API hook described in FIG. Completely delete through (S209). Subsequently, the user receives whether the log including the management list for each application is deleted from the user (S210), and when a delete request is input, the management list file for each application is completely deleted by referring to the management list for each application (S211a). After that (S211) the program is terminated (S212).

The present invention is not limited to the above-described embodiments, and the scope of application of the present invention is not limited to those of ordinary skill in the art to which the present invention pertains without departing from the gist of the present invention as claimed in the claims. Of course, various modifications can be made.

Claims

It is implemented in the form of a program executed by arithmetic processing means including a computer, by the program

a1) real-time monitoring whether a process of an application program is executed by configuring a process table linked with a timer;

a2) real-time tracing of the operation of the application program using the PID of the process when a process start of the application program is detected and placed in the process table;

a3) hooking the deletion API execution process when a process of executing a deletion API function for deleting a temporary file is detected among the processes of the application program;

a4) grasp the attributes, the size and the location of the temporary file by using variables of the delete API function, change the properties of the temporary file to be writable, and then in the area from the start position to the end position of the temporary file Overwriting at least one or more overwriting patterns by the size of the file;

a5) calling the original delete API function to be executed when the pattern overwriting is completed in the temporary file;

Method for automatically deleting the temporary files used in the application, characterized in that consisting of.
It is implemented in the form of a program executed by arithmetic processing means including a computer, by the program

b1) real-time monitoring whether a process of an application program is executed by configuring a process table linked with a timer;

b2) if a process start of an application is detected and entered in a process table, using the PID of the process to trace in real time the operation of the application;

b3) hooking the generated API execution process when a process of executing the generated API function for generating a temporary file is detected among the processes of the application program;

b4) identifying attributes, sizes, and locations of temporary files using variables of the generation API function, and managing and storing all files generated by the generation API execution process;

b5) if the process termination of the application is detected, tracking all temporary files except the original file among the management-listed files with reference to the stored management list;

b6) overwriting at least one or more overwriting patterns corresponding to the size of the temporary file in an area from the start position to the end position of the temporary file after changing the attribute of the temporary file to be writable;

b7) when the pattern is overwritten in the temporary file, deleting the overwritten temporary files and terminating the application program normally;

Method for automatically deleting the temporary files used in the application, characterized in that consisting of.
The method of claim 1, wherein the program is overwritten.

You can use the user input string pattern to perform the overwrite operation,

You can use the random string pattern to overwrite or

Depending on the DoD 5220 method, create and overwrite a pattern for overwriting,

When the Peter Gutmann method is selected, the automatic deletion of temporary files used in the application, which generates the pattern for overwriting and overwrites according to the Peter Gutmann method.
The method of claim 3, wherein the program is

When overwriting using a user input string pattern or a random string pattern, a method of automatically deleting a temporary file used in an application, characterized in that the repetitive overwrite is performed a number of times according to a user input or a predetermined number.
The method of claim 1, wherein the program is

Stored in a portable storage device including a USB device and automatically or manually executed when the portable storage device is connected to the processing unit;

p1) monitoring the application program (S101);

p2) hooking and tracing a process of creating or deleting a file (S102);

p31) if the hooked process is a file deletion process, completely deleting the temporary file to be deleted through the steps a4) to a5) (S104 to S105);

p4) detecting a removal request of the portable storage device (S108);

p7) terminating the program (S112);

Method for automatically deleting the temporary files used in the application, characterized in that consisting of.
The method of claim 2, wherein the program is

Stored in a portable storage device including a USB device and automatically or manually executed when the portable storage device is connected to the processing unit;

p1) monitoring the application program (S101);

p2) hooking and tracing a process of creating or deleting a file (S102);

p32) if the hooked process is a file generation process, managing listing the generated temporary file through the process of step b4) (S106 to S107);

p4) detecting a removal request of the portable storage device (S108);

p5) completely deleting the temporary file managed and listed in step p32) through the steps b5) to b7) (S109);

p6) Receiving whether or not to delete the log including the management list from the user (S110), if the deletion request is input by referring to the management list created in step p4 (S111a) to completely delete the management list file ( S111);

p7) terminating the program (S112);

Method for automatically deleting the temporary files used in the application, characterized in that consisting of.
The method of claim 1, wherein the program is

It is installed on the calculation processing means and is automatically or manually executed when the calculation processing system starts.

q1) monitoring the application program (S201);

q2) hooking and tracing a process of creating or deleting a file (S202);

q31) if the hooked process is a file deletion process, completely deleting the temporary file to be deleted through the steps a4) to a5) (S204 to S205);

Method for automatically deleting the temporary files used in the application, characterized in that consisting of.
The method of claim 2, wherein the program is

It is installed on the calculation processing means and is automatically or manually executed when the calculation processing system starts.

q1) monitoring the application program (S201);

q2) hooking and tracing a process of creating or deleting a file (S202);

q32) if the hooked process is a file generation process, managing list of generated temporary files for each application through the process of step b4) (S206 to S207);

q4) detecting an application termination request (S208);

q5) completely deleting the temporary file managed by the application program in step q32) through the processes of steps b5) to b7) (S209);

q6) Receiving whether the log including the management list for each application is deleted from the user (S210), and if a delete request is input, referring to the management list for each application created in step q4) (S211a) for each application. Completely deleting the management list file (S211);

Method for automatically deleting the temporary files used in the application, characterized in that consisting of.