iOS 환경에서 카카오톡 데이터 복호화 및 아티팩트 분석 연구

초록

Messenger conversation datum are stored in encrypted form on user devices and are used as important evidence in digital forensics. In particular, to analyze KakaoTalk conversations, database files must be extracted and decrypted. According to previous studies, KakaoTalk databases for Windows and macOS are protected by encryption techniques, such as AES and PBKDF2. Although decryption methods have been studied, public research on decryption of databases for iOS is insufficient. This paper presents a method of decrypting KakaoTalk databases for iOS and explains the data backup process and decryption algorithm. In addition, a test case was designed, and the accuracy of the algorithm was experimentally verified. The results of this study are expected to contribute to the analysis of user behavior and case development in criminal investigations using iPhones.

키워드