TY - GEN
T1 - Forensic analysis of residual information in adobe PDF files
AU - Chung, Hyunji
AU - Park, Jungheum
AU - Lee, Sangjin
PY - 2011
Y1 - 2011
N2 - In recent years, as electronic files include personal records and business activities, these files can be used as important evidences in a digital forensic investigation process. In general, the data that can be verified using its own application programs is largely used in the investigation of document files. However, in the case of the PDF file that has been largely used at the present time, certain data, which include the data before some modifications, exist in electronic document files unintentionally. Because such residual information may present the writing process of a file, it can be usefully used in a forensic viewpoint. This paper introduces why the residual information is stored inside the PDF file and explains a way to extract the information. In addition, we demonstrate the attributes of PDF files can be used to hide data.
AB - In recent years, as electronic files include personal records and business activities, these files can be used as important evidences in a digital forensic investigation process. In general, the data that can be verified using its own application programs is largely used in the investigation of document files. However, in the case of the PDF file that has been largely used at the present time, certain data, which include the data before some modifications, exist in electronic document files unintentionally. Because such residual information may present the writing process of a file, it can be usefully used in a forensic viewpoint. This paper introduces why the residual information is stored inside the PDF file and explains a way to extract the information. In addition, we demonstrate the attributes of PDF files can be used to hide data.
KW - Data hiding
KW - Digital evidence
KW - Information leakage
KW - PDF
KW - Residual Information
UR - http://www.scopus.com/inward/record.url?scp=79960122353&partnerID=8YFLogxK
U2 - 10.1007/978-3-642-22309-9_12
DO - 10.1007/978-3-642-22309-9_12
M3 - Conference contribution
AN - SCOPUS:79960122353
SN - 9783642223082
T3 - Communications in Computer and Information Science
SP - 100
EP - 109
BT - Future Information Technology - 6th International Conference, FutureTech 2011, Proceedings
T2 - 6th International Conference on Future Information Technology, FutureTech 2011
Y2 - 28 June 2011 through 30 June 2011
ER -