제4장 디지털 증거 - parkjonghyuk.net

1 SeoulTech 2011-2nd . 4 .. UCS Lab Tel: 970-6702. Email: jhpark1@snut ac kr .. , . , , .. , .. UCS Lab . 1.. 2.. (Exclusionary Rule of the Illegally Collected Evidence). ( , ( Hearsay Rule). 3 . 3.. 4.. UCS Lab .. (Electronic Evidence). , .. (ESI: Electronically Stored Information). (Electronically Stored Information) ESI . (Digital Evidence) .. IOCE(International Organization on Computer Evidence) .. SWGDE(Scientific Working Group on Digital Evidence) .. UCS Lab (1/3).. , , .. Contents , , .. , , . Characte .. : . ristics UCS Lab (2/3).)

2 UCS Lab (3/3).. UCS Lab . , . 0 1 . , , , . ( ). , . , . ( ). , .. ,, .. UCS Lab .. , .. , ( ). , .. UCS Lab (1/3). ( ), ( ).. , .. UCS Lab ( ), ( ). UCS Lab (2/3). ( ). ' .. , .. , .. ,, . , . , .. UCS Lab (3/3).. , .. , .. ( ).. , .. UCS Lab .. / / .. UCS Lab . (Exclusionary Rule of the Illegally Collected Evidence). , .. , .. , 308 2 . " .. ".. UCS Lab . ( , Hearsay).. (Hearsay Rule). ( ) .. 310 2 .. UCS Lab .. , , , , , , .. UCS Lab .. [ 315 ] .. , 315 , .. 315 ( ).. 1. , .. 2. , . 3.. UCS Lab .. , .. , .. UCS Lab . ( ). (Computer-generated Evidence).

3 , .. , , . ( ). (Computer Stored Evidence).. : .. UCS Lab . (Authenticity). , , , .. (Integrity).. (R li bilit ). (Reliability).. (Originality).. , , , . UCS Lab . (Authenticity). , , .. , .. ( - Chain of Custody). (Integrity).. , . , , ( ) .. , .. , . UCS Lab (1/2). (Originality). , .. , . , . , .. UCS Lab (2/2). (The Best Evidence Rule).. (Federal Rules of Evidence) . 1002 " , . , , . " .. 1001 1 . 1002 , , .. 1004 Best Evidence .. FRE 1004 (Federal Rules of Evidence). : .. : . : . UCS Lab .. , , , .. , , .. , , .. UCS Lab .. (Chain of Custody).

4 2 . " .. , , . , , . , , .. UCS Lab (Chain of Custody).. 2 . " .." .. , , . , , . , , . ( ). UCS Lab .. UCS Lab .. 2 .. ( ).. UCS Lab EnCase . Disk Imaging CRC' 64 Sector CRC. Case Info Of data MD5. MD5.'. V = h( H ) = h( I ) V ' = h( H ') = h( I '). UCS Lab .. , .. , .. UCS Lab . Encrypt Secret Key Document Certification RSA. Encryption Alice Valid D. Document t P bli Key Public K Certification RSA. D. Decryption i Bob UCS Lab .. UCS Lab (1/4).. 3 .. 3 , .. UCS Lab (2/4).. 3 .. UCS Lab (3/4).. , PDA, , PMP .. : .. UCS Lab (4/4).. 3.

5 UCS Lab (1)- . 99 123 [ ]. , .. " .. , . , .. ,, .. 313 . 1 .. UCS Lab 38/97. (2)- . 207 7257 [ ].. PC e-mailil . USB, PC, CD, e-mail .. , . , .. UCS Lab UCS Lab