Forensic analysis of privacy-oriented cryptocurrencies

Abstract

The privacy-oriented cryptocurrencies have built-in anonymity and privacy features that made them very difficult (nearly impossible) to trace funds back to a particular user or successfully seize funds present in a cryptocurrency wallet. Criminals use these currencies in different kinds of malware and DDOS extortion attacks to launder money. While academic research on Bitcoin is becoming more mainstream, the research on privacy-oriented cryptocurrencies is not very common. In this paper, we address the privacy-oriented cryptocurrencies Monero and Verge and investigate which valuable forensic artefacts the software of these cryptocurrencies leaves behind on a computer system. We examine different sources of potential evidence like the volatile memory, network traffic and hard disks of the system running the cryptocurrency software. In almost all sources of evidence there are valuable forensic artefacts. These artefacts vary from mnemonic seed phrases and plain text passphrases in the volatile memory to indicators of the use of a cryptocurrency in the captured network traffic.