Abstract: Disclosed herein are an evidence collection guidance method and apparatus for file selection. The evidence collection guidance method includes generating pieces of preliminary analysis information that are pieces of collection target information, setting levels of the pieces of preliminary analysis information based on predefined rules, and generating and outputting notification information including summary description information and follow-up measure items related to the pieces of preliminary analysis information corresponding to the levels.

Abstract: Disclosed herein are an evidence collection guidance method and apparatus for file selection. The evidence collection guidance method includes generating pieces of preliminary analysis information that are pieces of collection target information, setting levels of the pieces of preliminary analysis information based on predefined rules, and generating and outputting notification information including summary description information and follow-up measure items related to the pieces of preliminary analysis information corresponding to the levels.

Abstract: Disclosed herein are a logical imaging apparatus and method for digital forensic triage. The logical imaging method for digital forensic triage includes receiving files selected as a digital evidence target, creating a logical imaging file, inside of which is formatted in a predetermined file system structure, recording the selected files in accordance with the file system structure of the created logical imaging file, and storing selected file list information about a list of the recorded selected files, and creating a separate selected list information file and a separate logical imaging summary file outside the logical imaging file.