The advancement of mobile forensic technology has induced the increase of anti-forensic activities such as smartphone destruction, while prompting major manufacturers to strengthen their data encryption policies at the same time. Such changes resulted in forensic analysts having to perform ‘Chip-transplantation’ when extracting data from damaged smartphones. Chip-transplantation is a method referring to transplanting data storage and decryption modules from the original damaged device to a compatible device of same model. However, chip-transplantation consists of procedures such as chip-off which are risky in terms of data integrity, and require comprehensive understanding of the target device's hardware for a successful recovery. This study explores the improvements to chip-transplantation techniques that are compatible with Samsung's premium smartphone's AP and eSE modules. Experimental results indicate that for a successful data acquisition via Chip-Transplantation on Samsung smartphones, transplantation of the eSE module along with the AP and flash memory is required irrespective of user password settings. As there is a lack of research on the physical structure and PCB placement of the eSE, this study provides eSE's terminal information, PCB placement, and jump points to bypass damage to PCB pin terminals. Lastly, for cases where damage to AP or eSE modules is suspected prior to or after transplantation, this study suggests two less invasive and cost-effective diagnostic methods – smartphone log analysis during the boot process and current consumption pattern analysis – that can be used along with conventional continuity testing, thermal imaging, and X-ray analysis. As the adoption of dedicated encryption modules in smartphones grows with privacy protection schemes, this study will contribute to advancing the chip-transplantation success rate against ever-evolving hardware landscape.

With the advancement of offline Finding Network (OFN) technology, tracking tags are being utilized in various fields, including locating elderly individuals with dementia, caring for children, and managing lost items. Recently, however, tracking tags have been misused in stalking, surveillance, and debt collection, highlighting the growing importance of digital forensics in proving criminal acts. While there has been some research on Apple AirTag and Tile products, studies focusing on Samsung's tracking tag have been lacking. Therefore, this paper proposes digital forensic techniques for law enforcement agencies to analyze Samsung tracking tag applications to identify perpetrators and substantiate criminal activities. We analyzed six tags and three applications, recognizing tag identifiers, and confirmed that location data is stored in both plaintext and encrypted forms within SQLite databases and XML files. Additionally, we conducted experiments on five different anti-forensics scenarios: 1) deletion of a registered tracking tag, 2) deletion of location data, 3) account logout, 4) service withdrawal, and 5) application synchronization, finding meaningful results to substantiate criminal actions. Furthermore, we developed S.TASER (Smart Tag Parser) based on Python that allows for the identification of deleted tags, recovery of identification data, and visualization of collected location data per tag. S.TASER's code, experimental scenarios, and raw data are publicly available for further verification. This study aims to contribute to the global digital forensic industry by suggesting additional options for investigation and evidence gathering of crimes that make use of Network.

The advancement of mobile forensic technology has induced the increase of anti-forensic activities such as smartphone destruction, while prompting major manufacturers to strengthen their data encryption policies at the same time. Such changes resulted in forensic analysts having to perform ‘Chip-transplantation’ when extracting data from damaged smartphones. Chip-transplantation is a method referring to transplanting data storage and decryption modules from the original damaged device to a compatible device of same model. However, chip-transplantation consists of procedures such as chip-off which are risky in terms of data integrity, and require comprehensive understanding of the target device's hardware for a successful recovery. This study explores the improvements to chip-transplantation techniques that are compatible with Samsung's premium smartphone's AP and eSE modules. Experimental results indicate that for a successful data acquisition via Chip-Transplantation on Samsung smartphones, transplantation of the eSE module along with the AP and flash memory is required irrespective of user password settings. As there is a lack of research on the physical structure and PCB placement of the eSE, this study provides eSE's terminal information, PCB placement, and jump points to bypass damage to PCB pin terminals. Lastly, for cases where damage to AP or eSE modules is suspected prior to or after transplantation, this study suggests two less invasive and cost-effective diagnostic methods – smartphone log analysis during the boot process and current consumption pattern analysis – that can be used along with conventional continuity testing, thermal imaging, and X-ray analysis. As the adoption of dedicated encryption modules in smartphones grows with privacy protection schemes, this study will contribute to advancing the chip-transplantation success rate against ever-evolving hardware landscape.

With the advancement of offline Finding Network (OFN) technology, tracking tags are being utilized in various fields, including locating elderly individuals with dementia, caring for children, and managing lost items. Recently, however, tracking tags have been misused in stalking, surveillance, and debt collection, highlighting the growing importance of digital forensics in proving criminal acts. While there has been some research on Apple AirTag and Tile products, studies focusing on Samsung's tracking tag have been lacking. Therefore, this paper proposes digital forensic techniques for law enforcement agencies to analyze Samsung tracking tag applications to identify perpetrators and substantiate criminal activities. We analyzed six tags and three applications, recognizing tag identifiers, and confirmed that location data is stored in both plaintext and encrypted forms within SQLite databases and XML files. Additionally, we conducted experiments on five different anti-forensics scenarios: 1) deletion of a registered tracking tag, 2) deletion of location data, 3) account logout, 4) service withdrawal, and 5) application synchronization, finding meaningful results to substantiate criminal actions. Furthermore, we developed S.TASER (Smart Tag Parser) based on Python that allows for the identification of deleted tags, recovery of identification data, and visualization of collected location data per tag. S.TASER's code, experimental scenarios, and raw data are publicly available for further verification. This study aims to contribute to the global digital forensic industry by suggesting additional options for investigation and evidence gathering of crimes that make use of Network.

With the digitization of medical information, illegal activities such as medical crimes and insurance fraud through tampering have increased. Medical images are particularly vulnerable due to their nature as soft copies and their transmission over networks. National research institutions such as NIST provide guidelines that define security control elements for managing medical images, primarily out of concern for system vulnerabilities. However, there is still a lack of established or standardized digital forensic methodologies specifically tailored to the medical imaging domain. This study proposes a digital forensic technique for detecting manipulation in medical images. Two widely adopted PACS (Picture Archiving and Communication System) platforms were selected, and a dataset comprising 82 samples across 40 types of tampering scenarios was constructed. Tampering behaviors such as the editing or deletion of DICOM files were categorized, and forensic analysis of DICOM tags and system artifacts enabled identification of the type and origin of changes. An automated detection module was developed and tested on 110 validation cases. The results demonstrated accurate detection in all instances, depending on whether the changes were reflected in the actual DICOM files. This research marks the first digital forensic approach to medical image tampering detection and is expected to serve as a foundation for future investigative techniques in response to medical-related crimes.

현행 수사는 범죄 현장에서 확보한 DNA가 데이터베이스와 완전 일치할 때에만 용의자 특정이 가능하며, 일치하지 않을 경우 수사가 중단되는 구조적 한계가 있다. 이 한계를 극복하고, 장기 미제사건과 강력범죄 수사의 실효성을 높이기 위한 방안으로 가족검색 기법의 도입 가능성을 검토하였다. 가족검색은 DNA 데이터베이스에 등록된 개인과의 유전적 유사성을 분석해, 등록자의 가족 구성원을 간접적으로 특정하는 기법이다. 본 논문은 미국과 영국의 가족검색 법제 및 사례를 비교분석하고, 이를 통해 우리나라의 법적 공백과 운영 구조의 문제를 진단하였다. 두 국가는 법적 근거를 바탕으로 가족검색을 제한적 조건에서 시행하며, 사전 승인과 사후 감독 등 절차적 통제 장치를 갖추고 있다. 반면, 한국은 가족검색에 대한 법적 정의, 적용 요건, 통제 절차가 마련되어 있지 않으며, 경찰청과 검찰청의 이원화된 DNA 데이터베이스 운영은 효율성과 일관성에 한계를 보인다.<br/> 전문가와 일반인 207명을 대상으로 설문조사를 실시하여 가족검색 도입에 대한 사회적 인식과 수용 가능성을 분석하였다. 양 집단 모두 가족검색 도입에 긍정적이었으며, 과학수사 효과와 범죄 예방 측면에서 도입 필요성이 제기되었다. 동시에 개인정보 침해, 제도 오남용 등에 대한 우려도 나타났고, 법적 근거 마련과 절차적 통제의 필요성에 공감이 형성되었다.<br/> 이에 따라 본 연구는 가족검색의 법률상 개념 정의, 적용 요건의 명확화, 제한적 대상 범죄 설정, 영장에 기반한 집행 절차, 무관한 가족 구성원 보호 조치 등 입법적 개선 방안을 제안하였다. 가족검색은 기존 DNA 수사 시스템의 구조적 한계를 보완하고, 장기 미제사건 해결과 공공안전을 강화할 수 있는 과학수사 기법으로 평가된다. 법적 정당성과 윤리적 타당성을 확보한 상태에서 제한적이고 신중하게 도입되어야 한다. 가족검색은 형사사법의 정당성과 수사 실효성을 동시에 추구할 수 있는 정책적 대안으로, 법률 개정과 사회적 공론화를 바탕으로 제도화 여부를 검토할 필요가 있다.

To acquire data stored on damaged devices, forensic analysts have conventionally removed the flash memory from the device and directly extracted the data from it. This process, often called ‘chip-off’ technique, has faced difficulties in application as data encryption technologies are being widely adopted. Except for rare instances where highly advanced chip transplantation is necessary, analysts generally attempt to repair the damaged modules as much as possible. When critical modules in an iPhone are damaged, the device experiences a phenomenon known as panic-full, in which the device repeatedly reboots, preventing analysts from acquiring data within. This research reviews the previously disclosed causes and analysis methods of panic-full through experiments. Furthermore, for cases where module replacement does not resolve the panic-full status, this paper provides diagnosis methods to detect damages to logic boards and as well as jumper point information. Lastly, based on above findings, an improved physical recovery process for iPhones in panic-full status is suggested. This study has been conducted on limited models of iPhone models, yet with Apple's unified hardware ecosystem, the findings and methodologies suggested in this paper can be easily extended to other models.

디지털증거 압수·수색은 대상·절차의 특수성으로 인해 피압수자등의 방어권·프라이버시권과 같은 기본권을 침해할 개연성이 크다. 특히 수사기관이 정보저장매체를 반출할 경우 무관정보가 노출되어 권리침해 가능성이 증가한다. 하지만 수사기관의 재량을 축소하여 사전적 통제를 강화하는 방안은 쉽지 않고, 압수·수색영장 발부 전 피압수자등에 의한 사전통제 제도는 부재한 상황이다. 그러므로 사후적 통제수단으로서 준항고와 집행정지의 기능과 역할이 중요하다. 그리고 위 수단이 제대로 기능하기 위해서는 디지털증거 압수·수색 시 피압수자등에게 준항고청구권등을 고지해야 한다.그 구체적 필요성은 첫째, 디지털증거 압수·수색과 피의자신문 모두 피의자와 수사기관이 함께 증거를 수집하는 절차임에도 불구하고, 진술거부권·변호인조력권(이하 “진술거부권등”이라 한다) 고지의무와 같은 권리보호장치는 피의자신문에 더욱 잘 갖춰져 있다는 점이다. 진술거부권과 그 고지의무가 근거하고 있는 자기부죄금지원칙은 디지털증거 압수·수색에도 적용될 수 있다는 점을 고려할 때, 디지털증거 압수·수색에도 피의자신문에 준하는 권리보호장치로서 준항고청구권(준항고 법원의 집행정지 결정 포함) 고지의무를 도입할 필요가 있다. 또한 변호인조력권은 헌법 제12조 제4항 문언에도 불구하고 체포·구속시뿐만 아니라 전체 형사절차에 인정되는 바, 피의자신문에 그 고지의무가 도입된 것처럼 디지털증거 압수·수색에도 그 고지의무를 도입할 필요가 있다. 둘째, 디지털증거 압수·수색은 피압수자등과 수사기관 간 비대칭성이 크다는 점을 고려할 때, 무기평등의 원칙을 도모하기 위해서는 피의자신문에 준하는 권리보호장치로서 준항고청구권등 고지의무 도입이 필요하다는 점이다. 셋째, 우리 법령은 권리 고지의무를 확대하는 방향으로 발전해왔다는 점을 고려할 때 준항고청구권등 고지의무 도입이 필요하다는 점이다.이러한 필요성을 바탕으로 형사소송법등의 개정을 통해 준항고청구권등 고지의무를 법문언에 반영하는 방안을 제시한다. 먼저 형사소송법 제122조 제2항·제3항을 신설하여 디지털증거 압수·수색 시 준항고청구권등을 고지하도록하고, 압수조서에 고지 받았는지 여부 등을 기재하도록 하였다. 또한 형사소송 규칙 제58조 제2항을 신설하여 법원이 관행적으로 디지털증거 압수·수색영장에 별지 첨부하는 문서의 근거를 마련하고, 해당 문서에 준항고 및 집행정지의 법적 의미와 효과를 기재할 수 있도록 하여 위법한 압수·수색 처분에 대한 권리구제수단을 직관적으로 이해할 수 있도록 하였다. 위 형사소송법등 개정안은 최근 도입된 영장사본 교부의무, 정보저장매체 반출 시 기술적 절차 설명 및 안내서 교부의무와 결합하여 피압수자등이 용이하게 방어권을 행사할 수 있는 일련의 제도적 장치를 구축할 수 있을 것이다. 마지막으로 실효성 및 부작용에 대해 검토하면서 본 연구에 대한 의문을 해소하고자 하였다.