Extraction of residual information in the microsoft powerpoint file from the viewpoint of digital forensics considering PerCom environment

Jungheum Park, Bora Park, Sangjin Lee, Seokhie Hong, Jong Hyuk Park

    Research output: Chapter in Book/Report/Conference proceedingConference contribution

    3 Citations (Scopus)

    Abstract

    Electronic documents made by some application (e.g. Microsoft PowerPoint application) have traces of work like editing, and these traces exist in the format of electronic documents. In digital forensic investigation, examiners have failed to notice traces of past work. It is because of that the traces of the past work cannot be identified by its application easily. However, identifying traces of the past work is important for digital forensic investigation because this data can be essential information which is created by culprit's intention not appeared in electronic document. This paper focuses on analyzing the Microsoft PowerPoint application (version 97 - 2003) which has the feature that it has traces of past work. In case of Microsoft PowerPoint file, it is possible to identify traces of past work by analyzing saving algorithm of application. To detect the traces automatically, PRIX (PPT Residual Information extractor) tool is developed.

    Original languageEnglish
    Title of host publication6th Annual IEEE International Conference on Pervasive Computing and Communications, PerCom 2008
    Pages584-589
    Number of pages6
    DOIs
    Publication statusPublished - 2008
    Event6th Annual IEEE International Conference on Pervasive Computing and Communications, PerCom 2008 - Hong Kong, Hong Kong
    Duration: 2008 Mar 172008 Mar 21

    Publication series

    Name6th Annual IEEE International Conference on Pervasive Computing and Communications, PerCom 2008

    Other

    Other6th Annual IEEE International Conference on Pervasive Computing and Communications, PerCom 2008
    Country/TerritoryHong Kong
    CityHong Kong
    Period08/3/1708/3/21

    ASJC Scopus subject areas

    • Computer Networks and Communications
    • Communication

    Fingerprint

    Dive into the research topics of 'Extraction of residual information in the microsoft powerpoint file from the viewpoint of digital forensics considering PerCom environment'. Together they form a unique fingerprint.

    Cite this