SYSTEM FOR ANALYZING FORENSIC EVIDENCE USING IMAGE FILTER AND METHOD THEREOF

• US 20090136140A1
• Filed: 08/29/2008
• Published: 05/28/2009
• Est. Priority Date: 11/26/2007
• Status: Active Grant

• Current Assignee: Electronics and Telecommunications Research Institute
• Original Assignee: Electronics and Telecommunications Research Institute
• Inventors: KIM, Youngsoo, HONG, Dowon
• Granted Patent: US 8,422,730 B2
• Time in Patent Office: Days
• US Class Current: 382/209
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures

Abstract

The present invention provides a system for analyzing forensic digital evidence using an image filter and a method thereof. The system for analyzing forensic evidence using an image filter includes: a duplicator that creates a copy of digital evidence; a verifying unit that discriminates whether a copy and the original of the digital evidence are the same; an original storage that stores the original of the digital evidence; an evidence analyzer that classifies image files for the copy of the digital evidence stored in the original storage, on the basis of an image filtering model created by a learning model in accordance with predetermined categories, and then analyzes the evidence; and a reporting unit that creates a report about the result of evidence analysis. The image evidence analyzer includes an image file extractor, an image filtering model learning unit, an image filter, and a plurality of analyzers.

Claims

1. A system for analyzing digital forensic evidence using an image filter, comprising:

a duplicator that creates a copy of digital evidence;

a verifying unit that verifies whether the copy created by the duplicator is identical to the original of the digital evidence;

an original storage that stores the original of the digital evidence on the basis of the result determined by tho verifying unit;

an evidence analyzer that classifies image files of the copy of the digital evidence stored in the original storage into predetermined categories, using the image filter including an image filtering model created by a learning model, and then analyzes the evidence; and

a reporting unit that creates a report about the evidence analysis result obtained by the evidence analyzer.

2. The system of claim 1,

wherein the digital evidence stored in the original storage is image files collected from the hard disk of a computer or a memory of a digital device.

3. The system of claim 1,

wherein the evidence analyzer analyzes not only existing data and image files on the hard disk, but images restored from deleted and lost data and performs registry analysis, e-mail analysis, web history analysis, password analysis, and related keyword search analysis.

4. The system of claim 1,

wherein the evidence analyzer includes:

an image evidence analyzer that analyzes image evidence included in the copy of the digital evidence; and

one or more another analyzers that perform analysis for all evidence, such as the registry analysis, the web history analysis, the e-mail analysis, the web history analysis, the password analysis, and the related keyword search analysis, except for the image analysis.

5. The system of claim 4,

wherein the image evidence analyzer includes:

an image file extractor that extracts all of the images included in the copy of the digital evidence;

an image filtering model learning unit that receives learning sample images classified into predetermined categories, performs a pre-process, such as removing image frames or separating multi-images, and creates an image filtering model on the basis of characteristics, such as color and tone, which represent image properties extracted from the pre-processed learning sample images and a learning algorithm; and

an image filter that receives image files extracted by the image file extractor, filters the image files into predetermined categories using the image filtering model created by the image filtering model learning unit, and then outputs the analysis result of the image classified into the predetermined categories.

6. A method of analyzing digital forensic evidence using an image filter, comprising:

(a) acquiring digital evidence from the suspect'"'"'s PC and creating a copy of the acquired digital evidence by using a duplicator;

(b) verifying whether the copy of the digital evidence is identical to the original by using a verifying unit, and storing the original of the digital evidence into a safe original storage;

(c) analyzing the evidence using the copy of the digital evidence verified by an evidence analyzer; and

(d) creating an evidence analysis report by using a reporting unit.

7. The method of claim 6,

wherein the analyzing of the evidence (c) includes:

(c1) analyzing image evidence included in the copy of the digital evidence by using an image evidence analyzer; and

(c2) analyzing all evidence, except for image analysis, such as web history analysis and e-mail analysis, by using other analyzers.

8. The method of claim 7,

wherein the analyzing of image evidence included in the copy of the digital evidence (c1) includes:

(c11) extracting all of the images included in the copy of the digital evidence by using an image file extractor;

(c12) receiving learning sample images, performing a pre-process, such as removing image frames and separating multi-images, and then creating an image filtering model on the basis of characteristics, such as color and tone, which represent image properties extracted from the pre-processed learning sample images and a learning algorithm, by activating an image filtering model learning unit, by using an image filtering model learning unit; and

(c13) receiving the image files extracted by the image file extractor and providing the analysis result of the images classified into predetermined categories using the image filtering model created by the image filtering model learning unit, by using an image filter.

9. The method of claim 6,

wherein the analyzing of the evidence (c) includes analyzing not only present data and image files existing in the hard disk, but images restored from deleted or lost data.