A method and tool to recover data deleted from a MongoDB
DBMS stores an important data, which is one of the important analytical subjects for analysis in digital forensics. The technique of recovering deleted data from the DBMS plays an important role in finding the evidence in forensic investigation cases. Although relational DBMS is used as important da...
Saved in:
| Published in | Digital investigation Vol. 24; pp. 106 - 120 |
|---|---|
| Main Authors | , |
| Format | Journal Article |
| Language | English |
| Published |
Elsevier Ltd
01.03.2018
|
| Subjects | |
| Online Access | Get full text |
| ISSN | 1742-2876 1873-202X |
| DOI | 10.1016/j.diin.2017.11.001 |
Cover
| Abstract | DBMS stores an important data, which is one of the important analytical subjects for analysis in digital forensics. The technique of recovering deleted data from the DBMS plays an important role in finding the evidence in forensic investigation cases. Although relational DBMS is used as important data storage until now, NoSQL DBMSs is used more often due to the growing pursue of Big Data. This increases the potential to analyze a NoSQL DMBS in forensic cases. In reality, data from approximately 26,000 servers has been deleted by a massive ransom attack on vulnerable MongoDB server. Therefore, investigation of internal structure analysis and deleted data recovery techniques of NoSQL DBMS is essential.
In this paper, we research the recovery method on deleted data in MongoDB that is widely used. We have analyzed the internal structures of the WiredTiger and MMAPv1 storage engines, which are the MongoDB's disk-based storage engines. Moreover, we have implemented the recovery algorithm as a tool as well as have evaluated its performance on real and self-generated experiment data. |
|---|---|
| AbstractList | DBMS stores an important data, which is one of the important analytical subjects for analysis in digital forensics. The technique of recovering deleted data from the DBMS plays an important role in finding the evidence in forensic investigation cases. Although relational DBMS is used as important data storage until now, NoSQL DBMSs is used more often due to the growing pursue of Big Data. This increases the potential to analyze a NoSQL DMBS in forensic cases. In reality, data from approximately 26,000 servers has been deleted by a massive ransom attack on vulnerable MongoDB server. Therefore, investigation of internal structure analysis and deleted data recovery techniques of NoSQL DBMS is essential.
In this paper, we research the recovery method on deleted data in MongoDB that is widely used. We have analyzed the internal structures of the WiredTiger and MMAPv1 storage engines, which are the MongoDB's disk-based storage engines. Moreover, we have implemented the recovery algorithm as a tool as well as have evaluated its performance on real and self-generated experiment data. |
| Author | Yoon, Jongseong Lee, Sangjin |
| Author_xml | – sequence: 1 givenname: Jongseong surname: Yoon fullname: Yoon, Jongseong email: yoonjs53@naver.com – sequence: 2 givenname: Sangjin surname: Lee fullname: Lee, Sangjin email: sangjin@korea.ac.kr |
| BookMark | eNp9kMtOwzAQRS1UJNrCD7DyDySMHSd2JDalPKUiNiCxs4w9AVdpjByrEn-Po7Ji0c3c2Zy5OrMgsyEMSMglg5IBa662pfN-KDkwWTJWArATMmdKVgUH_j7LuxS84Eo2Z2QxjlsA3ra1mBO1ojtMX8FRMziaQujzoBFt2GOkziRDHfaY0NEuhh019DkMn-H25pycdqYf8eIvl-Tt_u51_VhsXh6e1qtNYSuAlOtrhxZry6pWOaNAcjRQV2CUQasAWsGF7IQUwjbcda7t8MM0vOK1YgJNtST8cNfGMI4RO_0d_c7EH81AT-56qyd3PblrxnR2z5D6B1mfTPJhSNH4_jh6fUAxS-09Rj1aj4NF5_NXknbBH8N_AQdvdb4 |
| CitedBy_id | crossref_primary_10_1109_ACCESS_2021_3052505 crossref_primary_10_1109_ACCESS_2020_2976885 crossref_primary_10_48084_etasr_7116 crossref_primary_10_1016_j_diin_2019_04_001 crossref_primary_10_1016_j_fsidi_2021_301218 crossref_primary_10_1109_ACCESS_2021_3124262 crossref_primary_10_3390_electronics11091347 crossref_primary_10_1016_j_fsidi_2020_300999 |
| Cites_doi | 10.1016/j.istr.2013.02.003 10.3745/KTCCS.2017.6.2.95 10.1016/j.diin.2015.05.013 10.1016/j.diin.2016.04.003 10.1016/j.diin.2009.01.003 10.3745/KTCCS.2016.5.5.117 10.1007/s00779-011-0428-7 10.1016/j.diin.2016.03.003 |
| ContentType | Journal Article |
| Copyright | 2017 Elsevier Ltd |
| Copyright_xml | – notice: 2017 Elsevier Ltd |
| DBID | AAYXX CITATION |
| DOI | 10.1016/j.diin.2017.11.001 |
| DatabaseName | CrossRef |
| DatabaseTitle | CrossRef |
| DatabaseTitleList | |
| DeliveryMethod | fulltext_linktorsrc |
| Discipline | Social Welfare & Social Work |
| EISSN | 1873-202X |
| EndPage | 120 |
| ExternalDocumentID | 10_1016_j_diin_2017_11_001 S1742287617302347 |
| GroupedDBID | --K --M ..I .~1 0R~ 0SF 13V 1B1 1~. 1~5 4.4 457 4G. 5GY 5VS 7-5 71M 8P~ AACTN AAEDT AAEDW AAIAV AAIKJ AAKOC AALRI AAOAW AAQFI AAXUO AAYFN ABBOA ABKBG ABMAC ABMVD ABXDB ABYKQ ACDAQ ACGFS ACHRH ACNNM ACNTT ACRLP ACZNC ADBBV ADEZE ADJOM ADMUD AEBSH AEKER AENEX AFKWA AFTJW AGHFR AGJBL AGUBO AGUMN AGYEJ AHZHX AIALX AIEXJ AIKHN AITUG AJBFU AJOXV ALEQD ALMA_UNASSIGNED_HOLDINGS AMFUW AMRAJ AOUOD AXJTR BKOJK BLXMC BNSAS CS3 DU5 EBS EFJIC EJD EO8 EO9 EP2 EP3 FDB FEDTE FIRID FNPLU FYGXN G-Q GBLVA GBOLZ HVGLF HZ~ IHE J1W KOM M41 MO0 N9A NCXOZ O-L O9- OAUVE OZT P-8 P-9 P2P PC. PQQKQ Q38 RIG ROL RPZ SDF SDG SES SEW SPC SSB SSL SSV SSZ T5K ~G- AATTM AAXKI AAYWO AAYXX ABJNI ABWVN ACLOT ACRPL ACVFH ADCNI ADNMO ADVLN AEIPS AEUPX AFPUW AIGII AIIUN AKBMS AKRWK AKYEP ANKPU CITATION EFKBS ~HD |
| ID | FETCH-LOGICAL-c300t-205dece5c1398da8072ea0530a8aec80094247f4744c62dfd9feba62325814ea3 |
| IEDL.DBID | .~1 |
| ISSN | 1742-2876 |
| IngestDate | Wed Oct 01 03:10:22 EDT 2025 Thu Apr 24 23:01:46 EDT 2025 Fri Feb 23 02:17:15 EST 2024 |
| IsPeerReviewed | false |
| IsScholarly | false |
| Keywords | NoSQL database forensics MongoDB Recovery of deleted data from database Database forensics |
| Language | English |
| LinkModel | DirectLink |
| MergedId | FETCHMERGED-LOGICAL-c300t-205dece5c1398da8072ea0530a8aec80094247f4744c62dfd9feba62325814ea3 |
| PageCount | 15 |
| ParticipantIDs | crossref_primary_10_1016_j_diin_2017_11_001 crossref_citationtrail_10_1016_j_diin_2017_11_001 elsevier_sciencedirect_doi_10_1016_j_diin_2017_11_001 |
| ProviderPackageCode | CITATION AAYXX |
| PublicationCentury | 2000 |
| PublicationDate | March 2018 2018-03-00 |
| PublicationDateYYYYMMDD | 2018-03-01 |
| PublicationDate_xml | – month: 03 year: 2018 text: March 2018 |
| PublicationDecade | 2010 |
| PublicationTitle | Digital investigation |
| PublicationYear | 2018 |
| Publisher | Elsevier Ltd |
| Publisher_xml | – name: Elsevier Ltd |
| References | Wright (bib23) Jan. 2005 Park, Jeong, Lee (bib18) 2017; 6 GitHub, Source code of snappy. Snappy for Windows Homepage, Snappy Library for .NET. Tung (bib21) Sep 5. 2017 Wagner, Rasin, Grier (bib22) 2015; 14 Choi, Jeong, Lee (bib2) Oct. 2013; 23 Fowler (bib5) Apr. 2007 GitHub, Python Tool for Deleted Document Recovery of mongodb 2.4. Kwon, Witeman (bib15) July 20 2015 Jeon, Bang, Byun, Lee (bib13) 2012; 16 Andlinger (bib1) Nov. 2013 Frühwirt, Huber (bib6) Apr. 2010 Kim, Park, Lee (bib14) 2016; 18 GitHub, Source Code of Variable-length Integer Encoding/Decoding Function of WiredTiger Storage Engine. Yoon, Jeong, Kang, Lee (bib25) 2016; 17 Frühwirt, Kieseberg (bib8) 2013; 17 Choi, Jeong, Yoon, Lee (bib3) 2016; 5 Lee, Lee, Lee (bib16) 2017; 11 MongoDB Homepage, MongoDB manual: Storage Engines. . Xu, Xu, Xu, Ren, Zhang, Zheng (bib24) 2014; 9 Pereira (bib19) 2009; 5 GitHub, MongoDB Source Code. DB-Engines Homepage Frühwirt, Kieseberg (bib7) 2012 Andlinger (10.1016/j.diin.2017.11.001_bib1) 2013 10.1016/j.diin.2017.11.001_bib4 Yoon (10.1016/j.diin.2017.11.001_bib25) 2016; 17 Frühwirt (10.1016/j.diin.2017.11.001_bib6) 2010 Xu (10.1016/j.diin.2017.11.001_bib24) 2014; 9 10.1016/j.diin.2017.11.001_bib12 Pereira (10.1016/j.diin.2017.11.001_bib19) 2009; 5 10.1016/j.diin.2017.11.001_bib10 10.1016/j.diin.2017.11.001_bib11 Fowler (10.1016/j.diin.2017.11.001_bib5) 2007 10.1016/j.diin.2017.11.001_bib9 10.1016/j.diin.2017.11.001_bib17 Wagner (10.1016/j.diin.2017.11.001_bib22) 2015; 14 Kwon (10.1016/j.diin.2017.11.001_bib15) 2015 Lee (10.1016/j.diin.2017.11.001_bib16) 2017; 11 Park (10.1016/j.diin.2017.11.001_bib18) 2017; 6 Wright (10.1016/j.diin.2017.11.001_bib23) 2005 Frühwirt (10.1016/j.diin.2017.11.001_bib7) 2012 Choi (10.1016/j.diin.2017.11.001_bib3) 2016; 5 Tung (10.1016/j.diin.2017.11.001_bib21) 2017 Kim (10.1016/j.diin.2017.11.001_bib14) 2016; 18 Choi (10.1016/j.diin.2017.11.001_bib2) 2013; 23 10.1016/j.diin.2017.11.001_bib20 Frühwirt (10.1016/j.diin.2017.11.001_bib8) 2013; 17 Jeon (10.1016/j.diin.2017.11.001_bib13) 2012; 16 |
| References_xml | – reference: GitHub, Python Tool for Deleted Document Recovery of mongodb 2.4. – volume: 14 start-page: S106 year: 2015 end-page: S115 ident: bib22 article-title: Database forensic analysis through internal structure carving publication-title: Digit. Investig. – year: Jan. 2005 ident: bib23 article-title: Oracle Database Forensics Using LogMiner – reference: MongoDB Homepage, MongoDB manual: Storage Engines. – start-page: 1028 year: Apr. 2010 end-page: 1036 ident: bib6 article-title: InnoDB database forensics publication-title: Advanced Information Networking and Applications (AINA), 2010 24th IEEE International Conference – volume: 17 start-page: 227 year: 2013 end-page: 238 ident: bib8 article-title: InnoDB database forensics: enhanced reconstruction of data manipulation queries from redo logs publication-title: Inf. Secur. Tech. Rep. – year: Apr. 2007 ident: bib5 article-title: Forensic analysis of a SQL server 2005 database server publication-title: Black Hat USA Conference – reference: GitHub, Source code of snappy. – volume: 23 start-page: 947 year: Oct. 2013 end-page: 955 ident: bib2 article-title: The method of recovery for deleted record in Oracle Database publication-title: J. Korea Inst. Inf. Secur. Cryptol. – volume: 11 year: 2017 ident: bib16 article-title: SPaRe: efficient SQLite recovery using database schema patterns publication-title: KSII Trans. Internet Inf. Syst. – reference: Snappy for Windows Homepage, Snappy Library for .NET. – year: July 20 2015 ident: bib15 article-title: South Korean Intelligence Employee Commits, Suicide, Leaves Note – volume: 5 start-page: 93 year: 2009 end-page: 103 ident: bib19 article-title: Forensic analysis of the Firefox 3 Internet history and recovery of deleted SQLite records publication-title: Digit. Investig. – reference: GitHub, Source Code of Variable-length Integer Encoding/Decoding Function of WiredTiger Storage Engine. – year: Sep 5. 2017 ident: bib21 article-title: MongoDB Ransacking Starts Again: Hackers Ransom 26,000 Unsecured Instances – volume: 6 start-page: 95 year: 2017 end-page: 104 ident: bib18 article-title: Digital forensic investigation of HBase publication-title: KIPS Trans. Comput. Commun. Syst. – year: 2012 ident: bib7 article-title: Innodb database forensics: reconstructing data manipulation queries from redo logs publication-title: 2012 Seventh International Conference on Availability, Reliability and Security (ARES), – volume: 16 start-page: 707 year: 2012 end-page: 715 ident: bib13 article-title: A recovery method of deleted record for SQLite database publication-title: Personal Ubiquitous Comput. – volume: 9 start-page: 2538 year: 2014 end-page: 2544 ident: bib24 article-title: A forensic analysis method for Redis database based on RDB and AOF file publication-title: J. Comput. – volume: 17 start-page: 53 year: 2016 end-page: 65 ident: bib25 article-title: Forensic investigation framework for the document store NoSQL DBMS: MongoDB as a case study publication-title: Digit. Investig. – reference: . – reference: DB-Engines Homepage, – reference: GitHub, MongoDB Source Code. – year: Nov. 2013 ident: bib1 article-title: RDBMS Dominate the Database Market, but NoSQL Systems are Catchingup – volume: 5 start-page: 117 year: 2016 end-page: 126 ident: bib3 article-title: Digital forensic investigation of Redis database publication-title: KIPS Trans. Comput. Commun. Syst. – volume: 18 start-page: S118 year: 2016 end-page: S124 ident: bib14 article-title: Recovery method of deleted records and tables from ESE database publication-title: Digit. Investig. – ident: 10.1016/j.diin.2017.11.001_bib12 – ident: 10.1016/j.diin.2017.11.001_bib4 – year: 2005 ident: 10.1016/j.diin.2017.11.001_bib23 – volume: 17 start-page: 227 issue: 4 year: 2013 ident: 10.1016/j.diin.2017.11.001_bib8 article-title: InnoDB database forensics: enhanced reconstruction of data manipulation queries from redo logs publication-title: Inf. Secur. Tech. Rep. doi: 10.1016/j.istr.2013.02.003 – ident: 10.1016/j.diin.2017.11.001_bib10 – volume: 6 start-page: 95 issue: 2 year: 2017 ident: 10.1016/j.diin.2017.11.001_bib18 article-title: Digital forensic investigation of HBase publication-title: KIPS Trans. Comput. Commun. Syst. doi: 10.3745/KTCCS.2017.6.2.95 – volume: 14 start-page: S106 year: 2015 ident: 10.1016/j.diin.2017.11.001_bib22 article-title: Database forensic analysis through internal structure carving publication-title: Digit. Investig. doi: 10.1016/j.diin.2015.05.013 – volume: 23 start-page: 947 issue: 5 year: 2013 ident: 10.1016/j.diin.2017.11.001_bib2 article-title: The method of recovery for deleted record in Oracle Database publication-title: J. Korea Inst. Inf. Secur. Cryptol. – year: 2007 ident: 10.1016/j.diin.2017.11.001_bib5 article-title: Forensic analysis of a SQL server 2005 database server – ident: 10.1016/j.diin.2017.11.001_bib20 – volume: 18 start-page: S118 year: 2016 ident: 10.1016/j.diin.2017.11.001_bib14 article-title: Recovery method of deleted records and tables from ESE database publication-title: Digit. Investig. doi: 10.1016/j.diin.2016.04.003 – start-page: 1028 year: 2010 ident: 10.1016/j.diin.2017.11.001_bib6 article-title: InnoDB database forensics – ident: 10.1016/j.diin.2017.11.001_bib9 – volume: 5 start-page: 93 issue: 3 year: 2009 ident: 10.1016/j.diin.2017.11.001_bib19 article-title: Forensic analysis of the Firefox 3 Internet history and recovery of deleted SQLite records publication-title: Digit. Investig. doi: 10.1016/j.diin.2009.01.003 – ident: 10.1016/j.diin.2017.11.001_bib17 – year: 2013 ident: 10.1016/j.diin.2017.11.001_bib1 – ident: 10.1016/j.diin.2017.11.001_bib11 – volume: 11 issue: 3 year: 2017 ident: 10.1016/j.diin.2017.11.001_bib16 article-title: SPaRe: efficient SQLite recovery using database schema patterns publication-title: KSII Trans. Internet Inf. Syst. – year: 2017 ident: 10.1016/j.diin.2017.11.001_bib21 – year: 2015 ident: 10.1016/j.diin.2017.11.001_bib15 – volume: 5 start-page: 117 issue: 5 year: 2016 ident: 10.1016/j.diin.2017.11.001_bib3 article-title: Digital forensic investigation of Redis database publication-title: KIPS Trans. Comput. Commun. Syst. doi: 10.3745/KTCCS.2016.5.5.117 – year: 2012 ident: 10.1016/j.diin.2017.11.001_bib7 article-title: Innodb database forensics: reconstructing data manipulation queries from redo logs – volume: 16 start-page: 707 issue: 6 year: 2012 ident: 10.1016/j.diin.2017.11.001_bib13 article-title: A recovery method of deleted record for SQLite database publication-title: Personal Ubiquitous Comput. doi: 10.1007/s00779-011-0428-7 – volume: 9 start-page: 2538 issue: 11 year: 2014 ident: 10.1016/j.diin.2017.11.001_bib24 article-title: A forensic analysis method for Redis database based on RDB and AOF file publication-title: J. Comput. – volume: 17 start-page: 53 year: 2016 ident: 10.1016/j.diin.2017.11.001_bib25 article-title: Forensic investigation framework for the document store NoSQL DBMS: MongoDB as a case study publication-title: Digit. Investig. doi: 10.1016/j.diin.2016.03.003 |
| SSID | ssj0029954 |
| Score | 1.8010764 |
| Snippet | DBMS stores an important data, which is one of the important analytical subjects for analysis in digital forensics. The technique of recovering deleted data... |
| SourceID | crossref elsevier |
| SourceType | Enrichment Source Index Database Publisher |
| StartPage | 106 |
| SubjectTerms | Database forensics MongoDB NoSQL database forensics Recovery of deleted data from database |
| Title | A method and tool to recover data deleted from a MongoDB |
| URI | https://dx.doi.org/10.1016/j.diin.2017.11.001 |
| Volume | 24 |
| hasFullText | 1 |
| inHoldings | 1 |
| isFullTextHit | |
| isPrint | |
| journalDatabaseRights | – providerCode: PRVESC databaseName: Baden-Württemberg Complete Freedom Collection (Elsevier) customDbUrl: eissn: 1873-202X dateEnd: 99991231 omitProxy: true ssIdentifier: ssj0029954 issn: 1742-2876 databaseCode: GBLVA dateStart: 20110101 isFulltext: true titleUrlDefault: https://www.sciencedirect.com providerName: Elsevier – providerCode: PRVESC databaseName: Elsevier ScienceDirect [Accès UNIL ; CHUV ; HEP Vaud ; Sites BCUL] customDbUrl: eissn: 1873-202X dateEnd: 20191231 omitProxy: true ssIdentifier: ssj0029954 issn: 1742-2876 databaseCode: ACRLP dateStart: 20170601 isFulltext: true titleUrlDefault: https://www.sciencedirect.com providerName: Elsevier – providerCode: PRVESC databaseName: Elsevier SD Freedom Collection Journals [SCFCJ] customDbUrl: eissn: 1873-202X dateEnd: 20191231 omitProxy: true ssIdentifier: ssj0029954 issn: 1742-2876 databaseCode: AIKHN dateStart: 20170601 isFulltext: true titleUrlDefault: https://www.sciencedirect.com providerName: Elsevier – providerCode: PRVESC databaseName: ScienceDirect (Elsevier) customDbUrl: eissn: 1873-202X dateEnd: 99991231 omitProxy: true ssIdentifier: ssj0029954 issn: 1742-2876 databaseCode: .~1 dateStart: 20040201 isFulltext: true titleUrlDefault: https://www.sciencedirect.com providerName: Elsevier – providerCode: PRVLSH databaseName: Elsevier Journals customDbUrl: mediaType: online eissn: 1873-202X dateEnd: 99991231 omitProxy: true ssIdentifier: ssj0029954 issn: 1742-2876 databaseCode: AKRWK dateStart: 20040201 isFulltext: true providerName: Library Specific Holdings |
| link | http://utb.summon.serialssolutions.com/2.0.0/link/0/eLvHCXMwnV3PS8MwFA5jXryIP3E6Rw7iRbq1WdJmxzkdU3EXHe5WkjSR6mjHqFf_dvOWdCjCDl4KDQ2U15eXL_T73ofQpaSMGBnzICRCBZQyGYiEZYGE04c0hhIJQuGnaTyZ0Yc5mzfQqNbCAK3S135X09fV2o_0fDR7yzzvPVssTSzet1swGN9QUJRTmoCLQfdrQ_Mg0O_MiSJBhpzEXjjjOF5ZnkMP1CjpQidPbwzzZ3P6seGM99GeR4p46F7mADV0cYjaTk6LX_XCiJXGV7geKFcfR4gPsbOExqLIcFWWC3vBcOi1GYuBDYrB-MaiTAy6EiywXdNv5e3NMZqN715Gk8B7IwSqH4aVTW6WaaWZsgiOZ4KHCdHCLqhQcKEVB8IgoYmhCaUqJpnJBkZLYbEOYTyiWvRPULMoC32KsEmICIVUkdQDKjmRA_jtoggJoRmgyFooqoOSKt84HPwrFmnNEHtPIZApBNKeKIAm10LXmzlL1zZj69OsjnX66-Ontq5vmXf2z3nnaNfecUcla6NmtfrUFxZbVLKzTp4O2hneP06m3wEZy3A |
| linkProvider | Elsevier |
| linkToHtml | http://utb.summon.serialssolutions.com/2.0.0/link/0/eLvHCXMwnV3PT8IwFG4QD3ox_owoag_GixmM0q7liChBBS5C5La0XWemZCNkXv3b7aMb0Zhw8LJDt2bL2-vr99Lvew-ha0UZiVUgPJ9I7VHKlCc5izwF2YeKY0oUCIVH42AwpU8zNqugXqmFAVplEftdTF9F62KkWVizuUiS5ovF0sTifbsFQ-MbyrfQtn0xhwys8bXmeRAoeOZUkaBD5kGhnHEkryhJoAhqizeglGfRGebP7vRjx-nvo70CKuKu-5oDVDHpIao7PS1-NfNYLg2-weVAtvw4QqKLXU9oLNMI51k2txcMWa91WQx0UAydbyzMxCAswRLbRf2W3d8do2n_YdIbeEVzBE-3fT-33s0iow3TFsKJSAqfEyPtivKlkEYLYAwSymPKKdUBieKoExslLdghTLSoke0TVE2z1JwiHHMifal0S5kOVYKoDpy7aEJ8qAYooxpqlUYJdVE5HBpYzMOSIvYegiFDMKRNKYAnV0O36zkLVzdj49OstHX46--HNrBvmHf2z3lXaGcwGQ3D4eP4-Rzt2jvC8crqqJovP82FBRq5ulw50jfsj80F |
| openUrl | ctx_ver=Z39.88-2004&ctx_enc=info%3Aofi%2Fenc%3AUTF-8&rfr_id=info%3Asid%2Fsummon.serialssolutions.com&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Ajournal&rft.genre=article&rft.atitle=A+method+and+tool+to+recover+data+deleted+from+a+MongoDB&rft.jtitle=Digital+investigation&rft.au=Yoon%2C+Jongseong&rft.au=Lee%2C+Sangjin&rft.date=2018-03-01&rft.issn=1742-2876&rft.volume=24&rft.spage=106&rft.epage=120&rft_id=info:doi/10.1016%2Fj.diin.2017.11.001&rft.externalDBID=n%2Fa&rft.externalDocID=10_1016_j_diin_2017_11_001 |
| thumbnail_l | http://covers-cdn.summon.serialssolutions.com/index.aspx?isbn=/lc.gif&issn=1742-2876&client=summon |
| thumbnail_m | http://covers-cdn.summon.serialssolutions.com/index.aspx?isbn=/mc.gif&issn=1742-2876&client=summon |
| thumbnail_s | http://covers-cdn.summon.serialssolutions.com/index.aspx?isbn=/sc.gif&issn=1742-2876&client=summon |