KR20120010441A - Portable digital forensic data acquisition device, data acquisition method, and program recording medium for executing the method - Google Patents

Abstract

The present invention relates to digital forensic data acquisition, comprising: a mobile communication terminal standard connector for connecting with a mobile communication terminal; A USB connector for connecting with a computer running digital forensic analysis software; A storage unit for receiving and storing raw data stored in the internal memory of the mobile communication terminal or deleted but remaining in the internal memory; And obtaining and storing the raw data from the mobile communication terminal in response to the data acquisition command received from the user and storing the raw data from the mobile communication terminal, and reading the raw data from the storage in response to the data transfer command received from the computer. By including a control unit for controlling the transmission to the, it is effective to obtain data stored in the mobile communication terminal in a convenient way in the field without the process of seizure search for those suspected suspects in the investigation agency .

Description

Portable digital forensic data acquisition apparatus, a data acquisition method, and a program recording medium for executing the method [Portable digital forensics data acquisition apparatus, data acquisition method, and computer readable medium]

TECHNICAL FIELD The present invention relates to digital forensic data acquisition, and more particularly, to raw data (eg, phone numbers, call lists, text messages stored in a mobile communication terminal or deleted but remaining in memory). The present invention relates to a portable forensic data acquisition device for acquiring data in the form of binary data that can be used in digital forensic software, a data acquisition method, and a program recording medium for executing the method.

Digital forensics is a series of tasks that collect, analyze, and report on data to submit electronic evidence to investigative agencies.

Since the conventional forensic devices are designed to be used in the office of the investigating agency, the investigating agency seizes the mobile terminal from the suspect in order to acquire and analyze the evidence in the mobile terminal, and bring it to the investigating agency's office to collect the evidence. It must be secured. Therefore, there is a problem in that data stored in a mobile communication terminal of a suspected person cannot be immediately secured in the field by a simple method.

The technical problem to be solved by the present invention is a portable digital forensic system for obtaining data stored in a mobile communication terminal in a convenient way in the field without a seizure search process for those suspected suspects in the investigation agency A data acquisition apparatus, a data acquisition method, and a program recording medium for executing the method are provided.

In addition, the technical problem to be solved by the present invention is to ensure the integrity of the data so that the data obtained from the mobile communication terminal in the field can be used as evidence of the investigative agency or law enforcement agency, and the analysis in the digital forensic analysis software The present invention provides a portable digital forensic data acquisition device, a data acquisition method, and a program recording medium for executing the method that can acquire data in a possible form.

In order to solve the above technical problem, a portable digital forensic data acquisition device according to an embodiment of the present invention, a mobile communication terminal standard connector for connecting with the mobile communication terminal; A USB connector for connecting with a computer running digital forensic analysis software; A storage unit for receiving and storing raw data stored in the internal memory of the mobile communication terminal or deleted but remaining in the internal memory; And obtaining the raw data from the mobile communication terminal in response to a data acquisition command received from a user and storing the raw data in the storage unit, and from the storage unit in response to a data transmission command received from the computer. And a control unit for controlling the data to be read and transmitted to the computer.

The control unit may determine whether the device connected through the mobile communication terminal standard connector is the mobile communication terminal, and integrate the USB with the communication protocol to match the interface of the mobile communication terminal according to the device type of the mobile communication terminal. A driver unit; And a USB mass storage driver for controlling data transmission to the computer.

The controller detects a model name and version information of the mobile communication terminal by analyzing a packet received from the mobile communication terminal, and stores the model name and version information of the mobile communication terminal previously stored in the storage unit so as to correspond to the model name and the version information. A packet analyzer searching for information about an operating system and a file system; And a data acquisition unit accessing an entry of the file system using an access command of the mobile communication terminal determined according to an operating system and a file system of the mobile communication terminal, and obtaining the raw data in the form of a file from the entry. can do.

The controller may further include a data classifying unit classifying the raw data acquired by the data obtaining unit by file types and storing the raw data in the storage unit.

The controller may further include an integrity verifier configured to store a hash value by applying a hash value including a hash algorithm including MD5, SHA1, or SHA256 to the raw data to secure the integrity of the raw data.

The device may further include a battery unit charged through the USB connector to supply power used in the portable digital forensic data acquisition device.

The apparatus may further include a user interface including a one touch button for receiving the data acquisition command from the user.

The user interface unit may further include a function selection switch for receiving information regarding a range of the data acquisition command from the user to acquire only data desired by the user.

The user interface unit may further include one or more LED indicators for externally indicating a power supply state of the battery unit, whether the portable digital forensic data acquisition device is in normal operation, or a communication state with the mobile communication terminal.

In addition, in order to solve the above technical problem, in the portable digital forensic data acquisition apparatus according to an embodiment of the present invention, the data acquisition method is received through a mobile communication terminal standard connector in response to a data acquisition command received from a user. Analyzing the packet to detect model name and version information of the mobile communication terminal, and searching for information on an operating system and a file system of the mobile communication terminal corresponding to the model name and the version information; An entry of the file system is accessed using an access command of the mobile communication terminal determined according to an operating system and a file system of the mobile communication terminal, and is stored or deleted from the entry in the internal memory of the mobile communication terminal. Obtaining raw data remaining in the internal memory in the form of a file; Classifying and storing the raw data by file type; Assigning and storing a hash value applying a predetermined hash algorithm to the raw data to secure the integrity of the raw data; And transmitting the raw data and the hash value classified by file type to the computer in response to a data transfer command received through a USB connector from a computer running digital forensic analysis software.

In addition, in order to solve the above technical problem, in the portable digital forensic data acquisition apparatus according to an embodiment of the present invention, a computer-readable recording medium on which a program for executing a data acquisition method is recorded is received from a user. Analyzing the packet received through the mobile communication terminal standard connector in response to the data acquisition command to detect the model name and version information of the mobile communication terminal, the operating system and file of the mobile communication terminal corresponding to the model name and the version information Searching for information about the system; An entry of the file system is accessed using an access command of the mobile communication terminal determined according to an operating system and a file system of the mobile communication terminal, and is stored or deleted from the entry in the internal memory of the mobile communication terminal. Obtaining raw data remaining in the internal memory in the form of a file; Classifying and storing the raw data by file type; Assigning and storing a hash value applying a predetermined hash algorithm to the raw data to secure the integrity of the raw data; And transmitting the raw data and the hash value classified by file type to the computer in response to a data transfer command received through a USB connector from a computer running digital forensic analysis software.

According to an embodiment of the present invention, by receiving the raw data of the mobile communication terminal through the mobile terminal standard connector and transmitting to the computer through the USB connector, the seizure search for those suspected suspects in the investigation agency There is an effect of acquiring the data stored in the mobile communication terminal in a convenient way in the field without the process of.

In addition, according to an embodiment of the present invention, the digital forensic analysis software by searching the operating system and file system of the mobile communication terminal using the model name and version information, and obtaining raw data in a file form from the mobile communication terminal according to the search result. It is effective to obtain data in a form that can be analyzed in.

In addition, according to an embodiment of the present invention, by transmitting the hash value to the computer together with the obtained file, the data obtained from the mobile communication terminal in the field can be used as evidence of the investigative agency or law enforcement agency It is effective to ensure the integrity of the.

1 is a view for explaining a connection structure between a portable digital forensic data acquisition device and another device according to an embodiment of the present invention.
2 is a diagram illustrating a user interface of a portable digital forensic data acquisition device according to an embodiment of the present invention by way of example.
3 is a block diagram schematically illustrating a hardware configuration of a portable digital forensic data acquisition device according to an embodiment of the present invention.
4 is a block diagram illustrating a configuration of a controller in a portable digital forensic data acquisition device according to an embodiment of the present invention.
5 is a flowchart illustrating a data acquisition method in a portable digital forensic data acquisition device according to an embodiment of the present invention.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a view for explaining a connection structure between a portable digital forensic data acquisition device and another device according to an embodiment of the present invention.

Referring to FIG. 1, a portable digital forensic data acquisition device 100 according to an embodiment of the present invention is stored as a portable device for acquiring data from a mobile communication terminal 130 such as a mobile phone, a PDA, or a smartphone. It is a device that maximizes the convenience of transportation and use.

The data obtained from the mobile communication terminal 130 is a system for controlling the operation of the mobile communication terminal 130 as well as user data such as a phone book, a text message, a recent call list, a picture, an MP3 file, a schedule, an office document or a video. Data may also be included.

In addition, the data obtained from the mobile communication terminal 130 includes not only data stored in the internal memory (not shown) of the mobile communication terminal 130 but also data deleted but remaining in the internal memory (not shown). do. For example, if a file is deleted from the FAT file system of a DOS or MS WINDOWS operating system, the file is deleted by changing the first character of the file name to OxE5, indicating that the file was deleted, and allocating the clusters that stored the deleted file from the FAT. By changing the values to 0, another file can be saved. However, even after the file is deleted, the information of the deleted file, that is, the file name, date, file size, start cluster of the file, and the like remains unchanged, so that it is possible to obtain deleted data using this information.

Portable digital forensic data acquisition device 100 is a mobile communication terminal standard connector 110 that can be directly connected without a separate conversion cable for fast and simple data acquisition from the mobile communication terminal 130, and digitally obtained data And a USB connector 120 for easy transfer to a computer 140 running forensic analysis software.

The portable digital forensic data acquisition device 100 is connected to the mobile communication terminal 130 by the mobile communication terminal standard connector 110, and is also connected to the computer 140 by the USB connector 120. The mobile communication terminal standard connector 110 may be directly connected to the mobile communication terminal 130 without a separate cable, but may also be connected to the mobile communication terminal 130 using a mobile communication terminal standard cable. The USB connector 120 may also be directly connected to the computer 140 without a separate cable, but may also be connected to the computer 140 using a USB cable.

2 is a diagram illustrating a user interface of a portable digital forensic data acquisition device according to an embodiment of the present invention by way of example.

Referring to FIG. 2, the portable digital forensic data acquisition apparatus 200 receives one-touch button 230 for receiving a power-on and data acquisition command from a user without complicated setting, and information about a range of the data acquisition command from the user. Function selection switch 240 to enable the user to obtain only specific data desired among various data stored in the mobile communication terminal 130, the battery power supply state, whether the portable digital forensic data acquisition device 200 operates normally, Or it may include a user interface, such as an LED indicator 250 for displaying the communication state with the mobile communication terminal 130 to the outside. The user interface is controlled by the controller 330 of FIG. 3 to be described later.

3 is a block diagram schematically illustrating a hardware configuration of a portable digital forensic data acquisition device according to an embodiment of the present invention.

Referring to FIG. 3, the portable digital forensic data acquisition device 300 includes a mobile communication terminal standard connector 310, a USB connector 320, a control unit 330, a storage unit 340, and a battery unit 350. . In addition, the controller 330 includes a central processing unit 332, a USB host controller 334, and a USB device controller 336. In addition, the battery unit 350 includes a lithium-ion battery 352 and a power supply 354.

The mobile terminal standard connector 310 connects the portable digital forensic data acquisition apparatus 300 and the mobile communication terminal 130, and the USB connector 320 connects the portable digital forensic data acquisition apparatus 300 and the computer 140. Connect.

The central computing unit 332 acquires raw data from the mobile communication terminal 130 through the mobile terminal standard connector 310 and the USB host controller 334 in response to a data acquisition command received from the user. 340 to control. In addition, the controller 330 controls to read the raw data from the storage unit 340 and transmit the read data to the computer 140 in response to a data transmission command received from the computer 140 running digital forensic analysis software. Here, raw data obtained from the mobile communication terminal 130 and transmitted to the computer 140 is stored in the internal memory (not shown) of the mobile communication terminal 130 or deleted but is stored in the internal memory (not shown). It remains and is recoverable data. The central operation unit 332 is preferably designed to be faithful to the low power design considering the characteristics of the portable device while operating at high speed to shorten the data acquisition time.

The USB host controller 334 controls communication with the mobile communication terminal 130 through the mobile terminal standard connector 310, and the USB device controller 336 communicates with the computer 140 through the USB connector 320. To control.

The storage unit 340 receives and stores raw data stored in the internal memory of the mobile communication terminal 130 or deleted from the controller 330 but remaining in the internal memory. The storage unit 340 may maximize the expandability of the device 300 using, for example, an SD card memory that can be easily removed and replaced.

The battery unit 350 automatically charges power through the USB connector 320 or supplies power required for the portable digital forensic data acquisition device 300 from the power supply device 354 using a battery or the like. The battery unit 350 may include, for example, a lithium-ion battery, but is not limited thereto, and various types of batteries may be used.

4 is a block diagram illustrating a configuration of a controller in a portable digital forensic data acquisition device according to an embodiment of the present invention.

Referring to FIG. 4, the control unit 400 of the portable digital forensic data acquisition device includes a device driver unit including a USB integrated driver unit 405 and a USB host driver 410, a packet analyzer 430, and a data acquisition unit. 435, an application unit including a data classifier 440, an integrity verifier 445, and a user interface 450.

In addition, the software configuration that can be implemented in the control unit 400 of the portable digital forensic data acquisition device can be equipped with a Linux OS that can be flexibly ported on various hardware platforms, and can obtain necessary data from various kinds of mobile communication terminals 130 without restriction. The USB host driver 410 and the ACM driver 425 may be used to acquire, and the USB mass storage driver 415 may be mounted to facilitate data transfer to the computer 140. In addition, in order to maximize the expandability of the device may be built-in easily replaceable SD card memory, in this case the SD card memory driver 420 for driving the SD card memory can be used.

Based on such an environment, an application for data acquisition of the mobile communication terminal 130 and smooth data transmission to the computer 140 may include a portion (packet analyzer 430) and data acquisition from the mobile communication terminal 130. Data acquisition unit 435, a portion for analyzing and storing the acquired information (data classification unit 440 and integrity verification unit 445), and a portion for transmitting the acquired data to the computer 140 (USB mass storage Driver 415), and a power management unit (not shown) that manages power by inspecting a battery charge / discharge state and a portion (user interface unit 450) for controlling the user interface described with reference to FIG. It may include.

Hereinafter, a process of acquiring and transmitting data by the controller 400 will be described.

When the mobile communication terminal 130 is connected to the portable digital forensic data acquisition device 300, the portable digital forensic data acquisition device 300 recognizes the connection of a new device through the USB host controller 334, and controls the controllers 300 and 400. The USB host driver 410, the ACM driver 425, and the packet analyzer 430 determine the type and shape of the recognized new device. When the connected device is determined as the mobile communication terminal 130, the controller 400 communicates with the mobile communication terminal 130 according to the data transmission mode defined for each type of the mobile communication terminal 130, and the mobile communication terminal 130. Access the internal memory of) to acquire data.

Since the data acquisition from the mobile communication terminal 130 requires a different communication method for each terminal manufacturer and model, and the standard ACM driver 425 or the USB mass storage driver 415 alone cannot sufficiently acquire desired data. Through the integrated driver 405 and the packet analyzer 430, a communication method suitable for the mobile communication terminal 130 may be found and a basic environment for data acquisition may be prepared.

The USB integrated driver unit 405 checks whether or not the device connected through the mobile communication terminal standard connector 110 is the mobile communication terminal 130 and according to the device type of the mobile communication terminal 130. 130) interface with the communication protocol. The USB integrated driver 405 may be in the form of a new device driver for an individual mobile communication terminal or in the form of a filter driver that modifies only a few elements while using a standard USB driver. If the standard USB device driver provided by the Linux OS cannot create the environment necessary for mobile terminal data acquisition, the interface and communication protocol of the mobile terminal are matched by defining and controlling the device type for each mobile terminal.

The packet analyzer 430 analyzes a packet received from the mobile communication terminal 130 to detect model name (including manufacturer information) and version information of the mobile communication terminal 130 and to correspond to the detected model name and version information. Search for information regarding an operating system and a file system of the mobile communication terminal 130 previously stored in the storage unit 340.

In addition, the packet analyzer 430 checks the model name and version information of the mobile communication terminal 130, and then communicates with the mobile communication terminal 130 at the maximum size of data that can be transmitted and received at once (maximum packet transmission amount). ) Is stored in a register in the control unit 400. The reason for doing this is to determine the total amount of data transmission based on the maximum size of data that can be exchanged at one time because the size of data received from the mobile communication terminal 130 is not always constant.

The data acquisition unit 435 determines an access command for the file system of the mobile communication terminal 130 according to the operating system and file system of the mobile communication terminal 130 identified by the packet analyzer 430, and determines the determined access command. By accessing the entry of the corresponding file system, the raw data as much as the user wants is obtained in the form of a file.

The fact that an interface for extracting data from the mobile communication terminal 130 is provided, does not mean that data can be freely obtained from all mobile communication terminals 130. This is because the operating system (OS) or file system (Filesystem) inside the mobile communication terminal 130 is different for each terminal manufacturer or model, and the terminal manufacturer is not a standardized and standardized method from the internal memory of the mobile communication terminal 130 (development). Since the necessary information is obtained by different commands and methods (internally promised according to the convenience), there is no standardized command system that anyone can easily obtain data from. Accordingly, the data acquiring unit 435 analyzes the operating system (OS) and the file system of the mobile communication terminal 130 based on the operating system (OS) and the file system (Filesystem) and the command system inside the mobile communication terminal 130 only for the purpose of data acquisition. To obtain the required data.

The data acquisition unit 435 accesses the file system of the mobile communication terminal 130 and reads out necessary data. The access command for each entry of the file system may be different for each terminal. Such an access command is one time when communicating with the mobile communication terminal 130 and the model name of the mobile communication terminal 130 obtained by the packet analyzer 430. It is determined based on information such as the maximum size (maximum packet transmission amount) of data that can be transmitted and received, and may be configured to read only specific data or sequentially read the entire data from the mobile communication terminal 130. Reading only specific data or sequentially reading the entire data can be selected by the function selection switch described in FIG.

The data classifying unit 440 classifies raw data acquired by the data obtaining unit 435 by file type (for example, call list, phone number, call list, text message, photo, etc., or file extension). Can be classified and classified) The necessary data is stored in the storage unit 340. The data classifying unit 440 may store the raw data acquired by the data obtaining unit 435 such as an operating system file required to drive the mobile communication terminal 130, a user file such as a phone number, a call list, a text message, a picture, and the like. It can also be classified as In addition, since most of the files that need data acquisition and recovery will be user files, the user files may be classified into user files that require data acquisition and recovery, and user files that do not require data acquisition and recovery. . The data classifier 440 may select a file desired by the user from the raw data acquired by the data acquirer 435, convert the file into a format readable by the user, and then store the file in the storage 340.

In addition, the data classifier 440 may reconfigure the classified data into the same form and structure as the internal memory of the mobile communication terminal 130 and store the classified data in the storage unit 340. When storing the data in the storage unit 340, the model name and the phone number of the mobile communication terminal 130 obtained the data are stored separately to store a plurality of data received from the plurality of mobile communication terminals in one portable digital forensic data acquisition device 300. It can be designed to be managed by.

Integrity verification unit 445 is given to the storage unit 340 by applying a hash value applying a hash algorithm including MD5, SHA1, or SHA256 to the raw data in order to secure the integrity of the raw data stored in the storage unit 340 Save it. As a result, the data obtained from the mobile communication terminal 130 is stored in the storage unit 340 of the portable digital forensic data acquisition device 300 as it exists in the form of a file in the file system of the mobile communication terminal 130. In addition, through the integrity verification to confirm that the file is intact, the data can be used as evidence in the investigative agency.

The user interface 450 controls the reception of the data acquisition command from the user through the one touch button, the reception of information regarding the range of the data acquisition command from the user through the function selection switch, and the LED indicator. Controls the display of the power supply state of the battery unit 350, whether the portable digital forensic data acquisition device 300 is in normal operation, or the communication state with the mobile communication terminal 130.

The portable digital forensic data acquisition device 300 is designed to be recognized as a mass storage device when connected to the computer 140. The SD card memory 340 is mounted as a logical drive by mapping a file system in order to be used as a mass storage device in the computer 140, and the computer 140 stores data acquired through the USB device controller 336 according to standardized protocols. Will output

5 is a flowchart illustrating a data acquisition method in a portable digital forensic data acquisition device according to an embodiment of the present invention.

Referring to FIG. 5, in step 505, the portable digital forensic data acquisition apparatus analyzes a packet received through a standard connector of a mobile communication terminal in response to a data acquisition command received from a user, thereby model name and version information of the mobile communication terminal. Detect.

In operation 510, the apparatus for acquiring portable digital forensic data searches for information about an operating system and a file system of the mobile communication terminal corresponding to the model name and version information detected in operation 505.

In operation 515, the portable digital forensic data acquisition device accesses an entry in the file system using an access command of the mobile communication terminal determined according to the operating system and file system of the mobile communication terminal found in step 510.

In operation 520, the portable digital forensic data acquisition device obtains raw data stored in the internal memory of the mobile communication terminal or deleted from the entry of the file system in the form of a file.

In operation 525, the portable digital forensic data acquisition apparatus classifies and stores raw data acquired in the form of a file in operation 520 by file type.

In operation 530, the portable digital forensic data acquisition apparatus stores and assigns a hash value applying a predetermined hash algorithm to the raw data in order to secure the integrity of the stored raw data classified by file type.

In step 535, the portable digital forensic data acquisition device receives the raw data classified by file type in step 525 and step 530 in response to a data transfer command received through a USB connector from a computer running digital forensic analysis software. Send the hash value to the computer.

In the portable digital forensic data acquisition apparatus according to an embodiment of the present invention, the data acquisition method may be embodied as computer readable codes on a computer readable recording medium. Computer-readable recording media include all kinds of storage devices that store data that can be read by a computer system. Examples of computer-readable recording media include ROM, RAM, CD-ROM, magnetic tape, floppy disk, optical data storage device, and the like. The computer readable recording medium may also be distributed over a networked computer system and stored and executed as computer readable code in a distributed manner.

So far I looked at the center of the preferred embodiment for the present invention. Those skilled in the art will appreciate that the present invention can be implemented in a modified form without departing from the essential features of the present invention. Therefore, the disclosed embodiments should be considered in descriptive sense only and not for purposes of limitation. The scope of the present invention is shown in the claims rather than the foregoing description, and all differences within the scope will be construed as being included in the present invention.

Claims (11)

A mobile communication terminal standard connector for connecting with a mobile communication terminal;
A USB connector for connecting with a computer running digital forensic analysis software;
A storage unit for receiving and storing raw data stored in the internal memory of the mobile communication terminal or deleted but remaining in the internal memory; And
Control to acquire and store the raw data from the mobile communication terminal in response to a data acquisition command received from a user, and store the raw data from the mobile communication terminal; And a control unit for controlling data to be read and transmitted to the computer. The method of claim 1, wherein the control unit,
A USB integrated driver unit checking whether a device connected through the standard terminal of the mobile communication terminal is the mobile communication terminal, and matching an interface and a communication protocol of the mobile communication terminal according to the device type of the mobile communication terminal; And
A portable digital forensic data acquisition device comprising a USB mass storage driver for controlling data transmission to the computer. 3. The apparatus of claim 2,
Analyzing the packet received from the mobile communication terminal to detect the model name and version information of the mobile communication terminal, the operating system and file system of the mobile communication terminal previously stored in the storage unit to correspond to the model name and the version information A packet analyzer searching for information about the packet; And
And a data acquisition unit accessing an entry of the file system using an access command of the mobile communication terminal determined according to an operating system and a file system of the mobile communication terminal, and obtaining the raw data from the entry in the form of a file. Portable digital forensic data acquisition device, characterized in that. The apparatus of claim 3,
And a data classifying unit for classifying the raw data acquired by the data obtaining unit by file type and storing the raw data in the storage unit. The method of claim 3 or 4, wherein the control unit,
In order to secure the integrity of the raw data, the digital digital forensics further comprises an integrity verification unit for assigning a hash value applying a hash algorithm including MD5, SHA1, or SHA256 to the raw data and storing it in the storage unit. Data Acquisition Device. The method of claim 1, wherein the device,
And a battery unit charged through the USB connector to supply power used in the portable digital forensic data acquisition device. The method of claim 1, wherein the device,
And a user interface unit including a one-touch button for receiving the data acquisition command from the user. The method of claim 7, wherein the user interface unit,
And a function selection switch for receiving information on the range of the data acquisition command from the user so as to acquire only the data desired by the user. The method of claim 7 or 8, wherein the user interface unit,
Portable digital forensic data further comprising at least one LED indicator for displaying the power supply state of the battery unit, whether the portable digital forensic data acquisition device is operating normally, or the communication state with the mobile communication terminal to the outside. Acquisition device. Analyzing the packet received through the mobile communication terminal standard connector in response to the data acquisition command received from the user to detect the model name and version information of the mobile communication terminal, the mobile communication terminal corresponding to the model name and the version information Searching for information about the operating system and file system of the;
An entry of the file system is accessed using an access command of the mobile communication terminal determined according to an operating system and a file system of the mobile communication terminal, and is stored or deleted from the entry in the internal memory of the mobile communication terminal. Obtaining raw data remaining in the internal memory in the form of a file;
Classifying and storing the raw data by file type;
Assigning and storing a hash value applying a predetermined hash algorithm to the raw data to secure the integrity of the raw data; And
And transmitting the raw data and the hash value classified by file type to the computer in response to a data transfer command received through a USB connector from a computer running digital forensic analysis software. Data acquisition method in forensic data acquisition device. Analyzing the packet received through the mobile communication terminal standard connector in response to the data acquisition command received from the user to detect the model name and version information of the mobile communication terminal, the mobile communication terminal corresponding to the model name and the version information Searching for information about the operating system and file system of the;
An entry of the file system is accessed using an access command of the mobile communication terminal determined according to an operating system and a file system of the mobile communication terminal, and is stored or deleted from the entry in the internal memory of the mobile communication terminal. Obtaining raw data remaining in the internal memory in the form of a file;
Classifying and storing the raw data by file type;
Assigning and storing a hash value applying a predetermined hash algorithm to the raw data to secure the integrity of the raw data; And
And transmitting the raw data and the hash value classified by file type to the computer in response to a data transfer command received through a USB connector from a computer running digital forensic analysis software. A computer-readable recording medium having recorded thereon a program for executing a data acquisition method in a forensic data acquisition device.

Images