Forensic investigation of Microsoft PowerPoint files
- Authors
- Park, Jungheum; Lee, Sangjin
- Issue Date
- 9월-2009
- Publisher
- ELSEVIER SCI LTD
- Keywords
- Digital forensics; Microsoft PowerPoint file; Residual information; Slide identifier; Object identifier
- Citation
- DIGITAL INVESTIGATION, v.6, no.1-2, pp.16 - 24
- Indexed
- SCIE
SCOPUS
- Journal Title
- DIGITAL INVESTIGATION
- Volume
- 6
- Number
- 1-2
- Start Page
- 16
- End Page
- 24
- URI
- https://scholar.korea.ac.kr/handle/2021.sw.korea/119381
- DOI
- 10.1016/j.diin.2009.05.001
- ISSN
- 1742-2876
- Abstract
- Nowadays, many electronic documents reside in individual systems and on public networks. Electronic documents contain important information such as private data and trade secrets. Because of this, electronic documents can be used as digital evidence in forensic investigations. Until now, forensic examiners have looked at the contents of an electronic document using specific applications, a procedure which fails to provide them with information about how an electronic document was created. Research into the process by which an electronic document is written can help forensic examiners discover the relationships among several electronic documents and the traces of past work in some special cases. This paper demonstrates new methods for investigating Microsoft PowerPoint files that include some useful information about their own writing process. (C) 2009 Elsevier Ltd. All rights reserved.
- Files in This Item
- There are no files associated with this item.
- Appears in
Collections - School of Cyber Security > Department of Information Security > 1. Journal Articles
Items in ScholarWorks are protected by copyright, with all rights reserved, unless otherwise indicated.