专利快速检索-快速检索全球专利，免费商用专利数据库-IPRDB

1. 发明授权

US07865493B2 Apparatus and method for searching for digital forensic data 有权
标题翻译：用于搜索数字法医数据的装置和方法
公开(公告)号：US07865493B2
公开(公告)日：2011-01-04
申请号：US12057428
申请日：2008-03-28
申请人： Ki Bom Kim , Sang Seo Park
发明人： Ki Bom Kim , Sang Seo Park
IPC分类号： G06F17/30
CPC分类号： G06F17/30106
摘要： Provided are an apparatus and method for searching for digital forensic data. In particular, provided are an apparatus and method for searching for digital forensic data capable of automatically determining a character encoding type that is used in searching for data. The apparatus for searching for digital forensic data includes: an imaging module for generating an image file from a data source; a file system analysis module for analyzing a file system of the image file to generate file system analysis information; a search module for determining a search character encoding type based on the file system analysis information and searching for the data using the search character encoding type; and a user interface for receiving a command related to a search from a user, transmitting the received command to the file system analysis module and the search module, and outputting the search results to the user. In searching for digital forensic data, information on an operating system, a processor and an active character encoding type, which are actually used by a suspect, is extracted to determine a search character encoding type, so that accuracy and efficiency of searching for data are increased, and time, effort and money spent in determining a character encoding type are reduced.
摘要翻译：提供了一种用于搜索数字取证数据的装置和方法。特别地，提供了一种用于搜索能够自动确定用于搜索数据的字符编码类型的数字取证数据的装置和方法。用于搜索数字取证数据的装置包括：成像模块，用于从数据源生成图像文件; 文件系统分析模块，用于分析图像文件的文件系统以生成文件系统分析信息; 搜索模块，用于基于文件系统分析信息确定搜索字符编码类型并使用搜索字符编码类型搜索数据; 以及用户接口，用于从用户接收与搜索有关的命令，将所接收的命令发送到文件系统分析模块和搜索模块，并将搜索结果输出给用户。在搜索数字取证数据时，提取实际由嫌疑人使用的操作系统，处理器和活动字符编码类型的信息，以确定搜索字符编码类型，从而搜索数据的准确性和效率是减少了用于确定字符编码类型所花费的时间，精力和时间。

2. 发明授权

US09164845B2 Partition recovery method and apparatus 有权
标题翻译：分区恢复方法和装置
公开(公告)号：US09164845B2
公开(公告)日：2015-10-20
申请号：US12626783
申请日：2009-11-27
申请人： Hyun Uk Hwang , Ki Bom Kim , Tae Joo Chang , Cheol Won Lee
发明人： Hyun Uk Hwang , Ki Bom Kim , Tae Joo Chang , Cheol Won Lee
IPC分类号： G06F12/00 , G06F17/30 , G06F11/14
CPC分类号： G06F11/1435
摘要： Provided is a technology which searches an unallocated area to quickly extract information on a deleted partition when checking a disk and an evidence image in digital forensic, and adds a recovered partition to a forensic tool as a new partition. For this, the technology has direct access to the sector of a disk or an evidence image which is obtained, limits information search on an unallocated area only to an area satisfying the minimum size in which a partition may be created, changes an LBA-based sector access scheme into a CHS-based sector access scheme, and reads only the sector of a location having the possibility that a boot record exists to search information of a deleted partition, recovering a partition at high speed.
摘要翻译：提供了一种搜索未分配区域以在数字取证中检查磁盘和证据图像时快速提取关于删除的分区的信息的技术，并且将恢复的分区作为新的分区添加到取证工具。为此，该技术可以直接访问所获得的磁盘或证据图像的扇区，仅在未分配区域上的信息搜索仅限于可以创建分区的满足最小大小的区域，改变基于LBA的扇区访问方案转换为基于CHS的扇区访问方案，并且仅读取具有引导记录存在的可能性以搜索被删除的分区的信息的位置的扇区，以高速恢复分区。

3. 发明授权

US09613207B2 Method and apparatus for preventing autorun of portable USB storage 有权
公开(公告)号：US09613207B2
公开(公告)日：2017-04-04
申请号：US12849068
申请日：2010-08-03
申请人： Hyun Uk Hwang , Ki Bom Kim , Gi Han Kim , Sung Il Lee , Tae Joo Chang , Cheol Won Lee
发明人： Hyun Uk Hwang , Ki Bom Kim , Gi Han Kim , Sung Il Lee , Tae Joo Chang , Cheol Won Lee
IPC分类号： G06F7/04 , G06F17/30 , H04N7/16 , G06F21/50 , G06F21/56 , G06F21/78
CPC分类号： G06F21/50 , G06F21/56 , G06F21/78
摘要： Provided is a technology which creates an autorun file that is used in autorun for preventing the autorun of a USB-based portable storage, thereby allowing an arbitrary user or worm virus not to manipulate the autorun file. A method for preventing autorun of portable storage accesses at least one of a master file table entry of a root directory and a master file table entry of an autorun file, and sets non-autorun in the at least one accessed master file table entry.

4. 发明授权

US08745100B2 Method and apparatus for collecting evidence 有权
标题翻译：收集证据的方法和装置
公开(公告)号：US08745100B2
公开(公告)日：2014-06-03
申请号：US12626786
申请日：2009-11-27
申请人： Ki Bom Kim , Hyun Uk Hwang , Young Chan Shin , Tae Joo Chang , Cheol Won Lee , Sung Jai Baik
发明人： Ki Bom Kim , Hyun Uk Hwang , Young Chan Shin , Tae Joo Chang , Cheol Won Lee , Sung Jai Baik
IPC分类号： G06F7/00 , G06F17/30
CPC分类号： G06Q10/10
摘要： Method and apparatus for collecting evidence are provided. An exemplary embodiment enhances accuracy and efficiency of collecting evidence by analyzing link information in the target computer and collecting collection target file. And the exemplary embodiment can collect evidence from a target computer as well as from a remote computer through analyzing the link information in the target computer, identifying the path of collection target file and extracting the target file.
摘要翻译：提供了收集证据的方法和装置。一个示例性实施例通过分析目标计算机中的链接信息并收集收集目标文件来提高收集证据的准确性和效率。并且，该示例性实施例可以通过分析目标计算机中的链接信息，识别收集目标文件的路径并提取目标文件来从目标计算机以及远程计算机收集证据。

你已经成功收藏专利！

检索式保存成功!

IPRDB

热门服务

关于我们

友情链接

联系方式