Extraction of residual information in the microsoft powerpoint file from the viewpoint of digital forensics considering PerCom environment

Jungheum Park, Bora Park, Sangjin Lee, Seokhie Hong, Jong Hyuk Park

Research output: Chapter in Book/Report/Conference proceedingConference contribution

3 Citations (Scopus)

Abstract

Electronic documents made by some application (e.g. Microsoft PowerPoint application) have traces of work like editing, and these traces exist in the format of electronic documents. In digital forensic investigation, examiners have failed to notice traces of past work. It is because of that the traces of the past work cannot be identified by its application easily. However, identifying traces of the past work is important for digital forensic investigation because this data can be essential information which is created by culprit's intention not appeared in electronic document. This paper focuses on analyzing the Microsoft PowerPoint application (version 97 - 2003) which has the feature that it has traces of past work. In case of Microsoft PowerPoint file, it is possible to identify traces of past work by analyzing saving algorithm of application. To detect the traces automatically, PRIX (PPT Residual Information extractor) tool is developed.

Original languageEnglish
Title of host publication6th Annual IEEE International Conference on Pervasive Computing and Communications, PerCom 2008
Pages584-589
Number of pages6
DOIs
Publication statusPublished - 2008 Aug 15
Event6th Annual IEEE International Conference on Pervasive Computing and Communications, PerCom 2008 - Hong Kong, Hong Kong
Duration: 2008 Mar 172008 Mar 21

Other

Other6th Annual IEEE International Conference on Pervasive Computing and Communications, PerCom 2008
CountryHong Kong
CityHong Kong
Period08/3/1708/3/21

Fingerprint

electronics
examiner
Digital forensics

ASJC Scopus subject areas

  • Computer Networks and Communications
  • Communication

Cite this

Park, J., Park, B., Lee, S., Hong, S., & Park, J. H. (2008). Extraction of residual information in the microsoft powerpoint file from the viewpoint of digital forensics considering PerCom environment. In 6th Annual IEEE International Conference on Pervasive Computing and Communications, PerCom 2008 (pp. 584-589). [4517460] https://doi.org/10.1109/PERCOM.2008.98

Extraction of residual information in the microsoft powerpoint file from the viewpoint of digital forensics considering PerCom environment. / Park, Jungheum; Park, Bora; Lee, Sangjin; Hong, Seokhie; Park, Jong Hyuk.

6th Annual IEEE International Conference on Pervasive Computing and Communications, PerCom 2008. 2008. p. 584-589 4517460.

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Park, J, Park, B, Lee, S, Hong, S & Park, JH 2008, Extraction of residual information in the microsoft powerpoint file from the viewpoint of digital forensics considering PerCom environment. in 6th Annual IEEE International Conference on Pervasive Computing and Communications, PerCom 2008., 4517460, pp. 584-589, 6th Annual IEEE International Conference on Pervasive Computing and Communications, PerCom 2008, Hong Kong, Hong Kong, 08/3/17. https://doi.org/10.1109/PERCOM.2008.98
Park J, Park B, Lee S, Hong S, Park JH. Extraction of residual information in the microsoft powerpoint file from the viewpoint of digital forensics considering PerCom environment. In 6th Annual IEEE International Conference on Pervasive Computing and Communications, PerCom 2008. 2008. p. 584-589. 4517460 https://doi.org/10.1109/PERCOM.2008.98
Park, Jungheum ; Park, Bora ; Lee, Sangjin ; Hong, Seokhie ; Park, Jong Hyuk. / Extraction of residual information in the microsoft powerpoint file from the viewpoint of digital forensics considering PerCom environment. 6th Annual IEEE International Conference on Pervasive Computing and Communications, PerCom 2008. 2008. pp. 584-589
@inproceedings{951bfd8ad7184321b6ca826d95432dd8,
title = "Extraction of residual information in the microsoft powerpoint file from the viewpoint of digital forensics considering PerCom environment",
abstract = "Electronic documents made by some application (e.g. Microsoft PowerPoint application) have traces of work like editing, and these traces exist in the format of electronic documents. In digital forensic investigation, examiners have failed to notice traces of past work. It is because of that the traces of the past work cannot be identified by its application easily. However, identifying traces of the past work is important for digital forensic investigation because this data can be essential information which is created by culprit's intention not appeared in electronic document. This paper focuses on analyzing the Microsoft PowerPoint application (version 97 - 2003) which has the feature that it has traces of past work. In case of Microsoft PowerPoint file, it is possible to identify traces of past work by analyzing saving algorithm of application. To detect the traces automatically, PRIX (PPT Residual Information extractor) tool is developed.",
author = "Jungheum Park and Bora Park and Sangjin Lee and Seokhie Hong and Park, {Jong Hyuk}",
year = "2008",
month = "8",
day = "15",
doi = "10.1109/PERCOM.2008.98",
language = "English",
isbn = "076953113X",
pages = "584--589",
booktitle = "6th Annual IEEE International Conference on Pervasive Computing and Communications, PerCom 2008",

}

TY - GEN

T1 - Extraction of residual information in the microsoft powerpoint file from the viewpoint of digital forensics considering PerCom environment

AU - Park, Jungheum

AU - Park, Bora

AU - Lee, Sangjin

AU - Hong, Seokhie

AU - Park, Jong Hyuk

PY - 2008/8/15

Y1 - 2008/8/15

N2 - Electronic documents made by some application (e.g. Microsoft PowerPoint application) have traces of work like editing, and these traces exist in the format of electronic documents. In digital forensic investigation, examiners have failed to notice traces of past work. It is because of that the traces of the past work cannot be identified by its application easily. However, identifying traces of the past work is important for digital forensic investigation because this data can be essential information which is created by culprit's intention not appeared in electronic document. This paper focuses on analyzing the Microsoft PowerPoint application (version 97 - 2003) which has the feature that it has traces of past work. In case of Microsoft PowerPoint file, it is possible to identify traces of past work by analyzing saving algorithm of application. To detect the traces automatically, PRIX (PPT Residual Information extractor) tool is developed.

AB - Electronic documents made by some application (e.g. Microsoft PowerPoint application) have traces of work like editing, and these traces exist in the format of electronic documents. In digital forensic investigation, examiners have failed to notice traces of past work. It is because of that the traces of the past work cannot be identified by its application easily. However, identifying traces of the past work is important for digital forensic investigation because this data can be essential information which is created by culprit's intention not appeared in electronic document. This paper focuses on analyzing the Microsoft PowerPoint application (version 97 - 2003) which has the feature that it has traces of past work. In case of Microsoft PowerPoint file, it is possible to identify traces of past work by analyzing saving algorithm of application. To detect the traces automatically, PRIX (PPT Residual Information extractor) tool is developed.

UR - http://www.scopus.com/inward/record.url?scp=49149087603&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=49149087603&partnerID=8YFLogxK

U2 - 10.1109/PERCOM.2008.98

DO - 10.1109/PERCOM.2008.98

M3 - Conference contribution

AN - SCOPUS:49149087603

SN - 076953113X

SN - 9780769531137

SP - 584

EP - 589

BT - 6th Annual IEEE International Conference on Pervasive Computing and Communications, PerCom 2008

ER -