System for analyzing forensic evidence using image filter and method thereof

• US 8,422,730 B2
• Filed: 08/29/2008
• Issued: 04/16/2013
• Est. Priority Date: 11/26/2007
• Status: Active Grant

• Current Assignee: Electronics and Telecommunications Research Institute
• Original Assignee: Electronics and Telecommunications Research Institute
• Inventors: Kim, Youngsoo, Hong, Dowon
• Primary Examiner(s): Wang, Claire X
• Assistant Examiner(s): Thirugnanam, Gandhi
• Application Number:
  US12/201,168
• Publication Number:
  US 20090136140A1
• Time in Patent Office: 1,691 Days
• Field of Search: 382/100
• US Class Current: 382/100
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures

Abstract

The present invention provides a system for analyzing forensic digital evidence using an image filter and a method thereof. The system for analyzing forensic evidence using an image filter includes: a duplicator that creates a copy of digital evidence; a verifying unit that discriminates whether a copy and the original of the digital evidence are the same; an original storage that stores the original of the digital evidence; an evidence analyzer that classifies image files for the copy of the digital evidence stored in the original storage, on the basis of an image filtering model created by a learning model in accordance with predetermined categories, and then analyzes the evidence; and a reporting unit that creates a report about the result of evidence analysis. The image evidence analyzer includes an image file extractor, an image filtering model learning unit, an image filter, and a plurality of analyzers.

Claims

1. A system for analyzing digital forensic evidence using an image filter, comprising:

a duplicator that creates a copy of digital evidence;

a verifying unit that verifies whether the copy created by the duplicator is identical to the original of the digital evidence;

an evidence analyzer that classifies image files of the copy of the digital evidence into predetermined categories, using the image filter including an image filtering model created by a learning model, and then analyzes the evidence; and

a reporting unit that creates a report about the evidence analysis result obtained by the evidence analyzer,

wherein the evidence analyzer analyzes not only existing data and image files on a hard disk, but also images restored from deleted and lost data and performs registry analysis, e-mail analysis, web history analysis, password analysis, and related keyword search analysis

wherein the learning model improves an accuracy of the classifying by learning more samples using resources in advance,

wherein the evidence analyzer includes;

an image evidence analyzer that analyzes image evidence included in the copy of the digital evidence,

an image file extractor that extracts all of the images included in the copy of the digital evidence;

an image filtering model learning unit that receives learning sample images classified into predetermined categories, performs a pre-process, including removing image frames or separating multi-images, and creates an image filtering model on the basis of characteristics, including color and tone, which represent image properties extracted from the pre-processed learning sample images and a learning algorithm, and

an image filter that receives image files extracted by the image file extractor, filters the image files into predetermined categories using the image filtering model created by the image filtering model learning unit, and then outputs the analysis result of the image classified into the predetermined categories.

2. The system of claim 1 wherein the copy of the digital evidence is image files collected from the hard disk of a computer or a memory of a digital device.