TY - GEN
T1 - Extraction of residual information in the microsoft powerpoint file from the viewpoint of digital forensics considering PerCom environment
AU - Park, Jungheum
AU - Park, Bora
AU - Lee, Sangjin
AU - Hong, Seokhie
AU - Park, Jong Hyuk
PY - 2008
Y1 - 2008
N2 - Electronic documents made by some application (e.g. Microsoft PowerPoint application) have traces of work like editing, and these traces exist in the format of electronic documents. In digital forensic investigation, examiners have failed to notice traces of past work. It is because of that the traces of the past work cannot be identified by its application easily. However, identifying traces of the past work is important for digital forensic investigation because this data can be essential information which is created by culprit's intention not appeared in electronic document. This paper focuses on analyzing the Microsoft PowerPoint application (version 97 - 2003) which has the feature that it has traces of past work. In case of Microsoft PowerPoint file, it is possible to identify traces of past work by analyzing saving algorithm of application. To detect the traces automatically, PRIX (PPT Residual Information extractor) tool is developed.
AB - Electronic documents made by some application (e.g. Microsoft PowerPoint application) have traces of work like editing, and these traces exist in the format of electronic documents. In digital forensic investigation, examiners have failed to notice traces of past work. It is because of that the traces of the past work cannot be identified by its application easily. However, identifying traces of the past work is important for digital forensic investigation because this data can be essential information which is created by culprit's intention not appeared in electronic document. This paper focuses on analyzing the Microsoft PowerPoint application (version 97 - 2003) which has the feature that it has traces of past work. In case of Microsoft PowerPoint file, it is possible to identify traces of past work by analyzing saving algorithm of application. To detect the traces automatically, PRIX (PPT Residual Information extractor) tool is developed.
UR - http://www.scopus.com/inward/record.url?scp=49149087603&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=49149087603&partnerID=8YFLogxK
U2 - 10.1109/PERCOM.2008.98
DO - 10.1109/PERCOM.2008.98
M3 - Conference contribution
AN - SCOPUS:49149087603
SN - 076953113X
SN - 9780769531137
T3 - 6th Annual IEEE International Conference on Pervasive Computing and Communications, PerCom 2008
SP - 584
EP - 589
BT - 6th Annual IEEE International Conference on Pervasive Computing and Communications, PerCom 2008
T2 - 6th Annual IEEE International Conference on Pervasive Computing and Communications, PerCom 2008
Y2 - 17 March 2008 through 21 March 2008
ER -