CAJ | 학술논문

TrueCrypt作为目前较为流行的免费开源加密软件之一，在不同平台上得到了广泛的应用。取证过程中经常要对磁盘中的加密文件检测以便进行进一步的解密分析，但由于TrueCrypt加密容器在解密之前不具备任何的签名、结构等特征，因此TrueCrypt加密容器的检测成为了取证过程中的一个难点。目前，还没有精确的TrueCrypt加密容器的检测方法，现有的检测技术主要是通过签名排除结合文件大小信息进行检测。文章在现有检测技术的基础上结合了卡方检验以及信息熵的理论方法，提出了一种TrueCrypt加密容器快速检测技术。该技术不仅能够快速的检测加密容器，而且和现有的检测方法相比检测精确度更高。
TrueCrypt작위목전교위류행적면비개원가밀연건지일，재불동평태상득도료엄범적응용。취증과정중경상요대자반중적가밀문건검측이편진행진일보적해밀분석，단유우TrueCrypt가밀용기재해밀지전불구비임하적첨명、결구등특정，인차TrueCrypt가밀용기적검측성위료취증과정중적일개난점。목전，환몰유정학적TrueCrypt가밀용기적검측방법，현유적검측기술주요시통과첨명배제결합문건대소신식진행검측。문장재현유검측기술적기출상결합료잡방검험이급신식적적이론방법，제출료일충TrueCrypt가밀용기쾌속검측기술。해기술불부능구쾌속적검측가밀용기，이차화현유적검측방법상비검측정학도경고。
TrueCrypt as one of the popular free open source encryption software has been widely applied on different platforms. Forensics process often to detected encrypted ifle for further decrypt and analysis, but TrueCrypt container has no signature and structure, so it is a dififcult to detect TrueCrypt container. In view of the TrueCrypt container ifle, there is no accurate detection method, the available technology is signature rule out combined ifle size limit to detect TrueCrypt container. In this paper, on the basis of the existing detection technology, combined with chi-square test and information entropy theory, we came up with a fast TrueCrypt container detection technology. This method not only can quickly detect TrueCrypt container, but higher precision compared with the existing detection methods.