Comparative Analysis of Cloning-Hashing Applications for Securing Digital Evidence

Abstract

The development of the Internet has resulted in an increasing variety of cyber crimes. Cybercrime is closely related to digital evidence, so cybercriminals tend to delete, hide, and format all collected data to eliminate traces of digital evidence. This digital evidence is very vital in proving at trial, so it is necessary to develop applications to secure digital evidence. This study aims to compare the results of cloning and hashing in securing digital evidence and evaluate the performance of a digital forensic application developed under the name Clon-Hash Application v1 compared to applications commonly used by investigators including Autopsy, FTK Imager, md5.exe in terms of its function, the result, CPU usage. The results of the research conducted show that the cloning process is perfectly successful, as evidenced by the hash value results which are the same as paid applications and there are even several other applications that have not been able to display the hash value. Hash values in the Clon-Hash v1 application also vary from MD5, SHA1, and SHA256 which do not exist in other applications. Applications developed are better in terms of function, results, and CPU usage.