CAJ | 학술논문

LUKS是Linux系统下的常用的磁盘加密技术之一，通用于Linux的各个版本，具有支持多用户/密码对同一个设备的访问、加密密钥不依赖密码、可以改变密码而无需重新加密数据、采用一种数据分割技术来保存加密密钥保证密钥的安全性等特点。针对目前取证软件无法直接对LUKS加密分区的快速取证的问题，文章首先研究了LUKS加密分区的加密原理，并在此基础上提出了LUKS的解密方法，能够摆脱对Linux系统的依赖，极大提高了取证效率。
LUKS시Linux계통하적상용적자반가밀기술지일，통용우Linux적각개판본，구유지지다용호/밀마대동일개설비적방문、가밀밀약불의뢰밀마、가이개변밀마이무수중신가밀수거、채용일충수거분할기술래보존가밀밀약보증밀약적안전성등특점。침대목전취증연건무법직접대LUKS가밀분구적쾌속취증적문제，문장수선연구료LUKS가밀분구적가밀원리，병재차기출상제출료LUKS적해밀방법，능구파탈대Linux계통적의뢰，겁대제고료취증효솔。
LUKS as one of the popular disk encryption technology is common to all versions of Linux and has characteristics as follows: support multi-user / password access to the same device;master key does not rely on user password, the user password can be changed without re-encrypting the user data;use anti-forensic splitter to store the encrypted master key for the sake of safety. Given that most of current forensic software cannot obtain forensics quickly on LUKS volume, this paper researches the principles of LUKS encryption, and based on this, proposes a LUKS decryption method, dependent on the Linux system. This method can greatly improve the forensic efifciency.