A Procedure for Tracing Chain of Custody in Digital Image Forensics: A Paradigm Based on Grey Hash and Blockchain

Mohamed Ali,Ahmed Ismail,Saad Darwish,Hany Elgohary,Saleh Mesbah

doi:10.3390/sym14020334

Abstract

Digital evidence is critical in cybercrime investigations because it is used to connect individuals to illegal activity. Digital evidence is complicated, diffuse, volatile, and easily altered, and as such, it must be protected. The Chain of Custody (CoC) is a critical component of the digital evidence procedure. The aim of the CoC is to demonstrate that the evidence has not been tampered with at any point throughout the investigation. Because the uncertainty associated with digital evidence is not being assessed at the moment, it is impossible to determine the trustworthiness of CoC. As scientists, forensic examiners have a responsibility to reverse this tendency and officially confront the uncertainty inherent in any evidence upon which they base their judgments. To address these issues, this article proposes a new paradigm for ensuring the integrity of digital evidence (CoC documents). The new paradigm employs fuzzy hash within blockchain data structure to handle uncertainty introduced by error-prone tools when dealing with CoC documents. Traditional hashing techniques are designed to be sensitive to small input modifications and can only determine if the inputs are exactly the same or not. By comparing the similarity of two images, fuzzy hash functions can determine how different they are. With the symmetry idea at its core, the suggested framework effectively deals with random parameter probabilities, as shown in the development of the fuzzy hash segmentation function. We provide a case study for image forensics to illustrate the usefulness of this framework in introducing forensic preparedness to computer systems and enabling a more effective digital investigation procedure.

Highlights

Any digital data containing trustworthy information that supports an event hypothesis is considered digital evidence
By using fuzzy hash functions, forensic investigators may effectively address permitted modification of digital evidence, while traditional hash techniques are useless in this scenario
This study focuses on Proof of Authority (PoA), which is usually used in permissioned networks, i.e., networks in which nodes cannot join and become validators freely

Summary

Introduction

Any digital data containing trustworthy information that supports an event hypothesis is considered digital evidence. Digital evidence’s extent is continuously increasing, including both established and emerging technology such as computers, networks, memory, and mobile devices [1]. Digital evidence has many features, including the ease with which it can be copied and transferred, the ease with which it can be changed and deleted, the ease with which it may be tainted by new data, and the fact that it is timesensitive. Digital evidence may be transferred across countries. Digital evidence may take the form of images, videos, text, or device logs. It incorporates data from social media platforms such as Twitter, Instagram, and Facebook [3,4,5,6,7,8,9,10]

Objectives

Methods

Findings

Conclusion