Sang Su Lee

GPU-Accelerated Password Cracking of PDF Files

Digital document file such as Adobe Acrobat or MS-Office is encrypted by its own ciphering algorithm with a user password. When this password is not known to a user or a forensic inspector, it is necessary to recover the password to open the encrypted file. Password cracking by brute-force search is a perfect approach to discover the password but a time consuming process. This paper presents a new method of speeding up password recovery on Graphic Processing Unit (GPU) using a Compute Unified Device Architecture (CUDA). PDF files are chosen as a password cracking target, and the Abode Acrobat password recovery algorithm is examined. Experimental results show that the proposed method gives high performance at low cost, with a cluster of GPU nodes significantly speeding up the password recovery by exploiting a number of computing nodes. Password cracking performance is increased linearly in proportion to the number of computing nodes and GPUs.

A New Anti-Forensic Tool Based on a Simple Data Encryption Scheme

In this paper, we discuss a simple encryption scheme in which a secret file is encrypted twice: one by a common encryption algorithm like AES and another by XOR. Despite the first key is revealed by guessing or dictionary-based attack, the attacker can not reconstruct the original secret until knows the files used to derive the second key block according to our scheme. We also give an explanation about the tool in which the proposed scheme is implemented. It consists of 1 main module and 5 sub-modules: main routine, command parser, file 10, buffer manager, cipher, and time handler. The design goals of the tool include encrypting a file with or without the second encryption and modifying times tamp values such as MAC time information. In addition, the second key can be derived from 3 files at most which are selected and specified as input arguments by a user.

A high speed disk imaging system

Recently, the capacity of digital storages for PCs gets larger, and forensic investigators need a system or a tool for imaging them in high speed. In this paper, we describe the high speed disk imaging system for the forensic purpose and report its performance.