Integrity Of Digital Evidence Research Articles

Chain of Custody and Evidence Integrity Verification Using Blockchain Technology

The validity and integrity of digital evidence and the chain of custody are crucial to all digital forensic investigations. All new evidence and access logs of the original evidence should be logged in a document called the ‘chain of custody’. This document shows the timeline of any piece of evidence from the time it was recorded until the end of the investigation. In a traditional digital investigation, trusted parties, such as an investigator, are allowed access to the digital evidence and follow a strict process when dealing with data. These trusted parties have the capability to alter the data making the evidence inadmissible in a court of law. Alternatively, these trusted parties may also alter the data accidentally or with malicious intent, due to a lack of transparency and non-repudiation. Blockchain technology can solve this issue, however, existing research shows that adopting blockchain does not provide adequate transparent access control mechanisms. Consequently, this makes blockchain difficult to adopt due to the one-to-one mapping and the inability to easily validate the chain of custody and evidence admissibility. Current methodologies rely on an external off-chain access control mechanism, which, regrettably, remains susceptible to potential breaches that could compromise its integrity and validity. This paper proposes an enhanced model to provide access control through smart contracts, ensuring immutability, flexibility, transparency, and non-repudiation of both the access control mechanisms and the digital evidence itself. This is achieved by moving the access control mechanism to the blockchain. This tracks any changes made through the access control mechanism, further ensuring transparency and integrity. This smart contract-based access control builds off role-based access control, allowing for more complex hierarchies to be used. This model aims to allow for both modularity, making adoption easier for existing digital forensic tools, and encouraging digital investigation and litigation to become more streamlined. Existing tools can easily integrate with the proposed model adding an extra layer of non-repudiation, transparency, and integrity.

Preserving Digital Evidence in Real Time Cloud Environment for Integrity and Legal Admissibility

Abstract: The emergence of cloud computing has transformed the manner in which organizations handle their data and digital assets, delivering unmatched convenience and scalability. Though with this, it has also brought about new and unique challenges in preservation of digital evidence in ensuring integrity and admissibility in legal proceedings. To enhance the credibility of digital evidence, the study will review literature on specialized software tools and techniques that help in preserving evidence in its unaltered state for legal examination. The researcher will determine the effectiveness of cryptographic techniques in ensuring integrity of digital evidence that is stored in cloud environment. A comparative analysis will be done. The study will give an overview of different techniques and critical considerations that will facilitate the admissibility of digital evidence in legal proceedings. This will help in revealing the gaps in digital forensics in a Cloud Environment.

Electronic Evidence: A Framework for Applying Digital Forensics to Data Base

ABSTRACT Accounting data bases contain much information reflecting a company’s financial performance, clients, suppliers, and other relevant information about the company’s activities. Thus, attracting criminal activity is empowered by a wide range of new and evolving digital technologies. More interestingly, all of these electronic media create digital traces, providing useful information for the digital investigation process. As digital crime targeting millions of pieces of sensitive information from data bases is rising, specific expertise and an informed approach in data base forensics are required. This study suggests an enhanced meta-framework, named data base evidence finding investigation (DEFI), to investigate an accounting data base to detect tampering. DEFI offers more targeted and streamlined guidance for data base experts to perform investigations while preserving the digital evidence's integrity and leaving it unchanged. Using an example, we demonstrate that the proposed enhanced meta-framework can guide the detection of suspicious transactions in an accounting data base.

Evidence Based Reconstruction for Digital Forensics

Evidence based reconstruction may often be even more illuminating than other traditional evidence gathering strategies, but it is also extremely delicate and unpredictable due to the fact that evidence may not always be conclusive. The integrity of digital evidence is therefore extremely important, particularly when it comes from allegedly unlawful, illegitimate, or harmful activity. Regardless of the good or bad consequences of the acts and activities that created the evidence, the capture and reconstruction of events are critical to the operation of the digital world. Owing to the lack of skill and knowledge of digital forensics in Ghana, it creates a susceptible environment for criminals to continue their operations while avoiding prosecution due to a lack of evidence to prosecute them. The reconstruction of occurrences based on evidence is considered an eminent need for Africa and for that matter Ghana. Hence, the need for well-defined and advanced knowledge in evidence based reconstruction in digital forensics investigation to bridge the gap currently existing. This paper reviews literature on the concept of evidence based reconstruction as a means to advance knowledge on its relevance to the Africa region and Ghana for that matter. This would help forensics investigators to better understand the need for focus on using digital tools for reconstruction and focusing on evidence driven activities in case of crime and investigations. Finally, this paper presents an elaborated view from a literature point of view over the evidence based reconstruction and also helps other fellow colleagues in their quest to further understand the concept. Keywords: Evidence, Reconstruction, Digital evidence, Digital forensics, Investigation.

ЖИНОЯТ ИШЛАРИНИ ТЕРГОВ ҚИЛИШДА РАҚАМЛИ ДАЛИЛЛАР БИЛАН ИШЛАШНИНГ ЎЗИГА ХОС ЖИҲАТЛАРИ

Digital evidence is one of the most effective means of administering justice in modern society. It simply depends on the types of digital evidence and how to use them. Therefore, this article focuses on the general concept of digital evidence, its sources and collection of digital information in criminal investigations, the basic principles of working with digital evidence, and the specific criteria for ensuring the integrity of digital evidence and evaluating them in investigative and judicial practice. In order to highlight these issues, modern procedures created by international organizations, developed countries and best practices have been used, and their advantages and disadvantages have been analyzed. In addition, problems in national practice and legislation on working with digital evidence have been systematically analyzed and practical solutions have been developed. The purpose of this article is to describe the state of digital evidence practice in the Republic of Uzbekistan and to apply experience of developed countries and best practice for future laws, procedures, guidelines and instruction on these issues, also to make recommendations on the development of digital evidence norms in accordance with international standards and law.

A Procedure for Tracing Chain of Custody in Digital Image Forensics: A Paradigm Based on Grey Hash and Blockchain

Digital evidence is critical in cybercrime investigations because it is used to connect individuals to illegal activity. Digital evidence is complicated, diffuse, volatile, and easily altered, and as such, it must be protected. The Chain of Custody (CoC) is a critical component of the digital evidence procedure. The aim of the CoC is to demonstrate that the evidence has not been tampered with at any point throughout the investigation. Because the uncertainty associated with digital evidence is not being assessed at the moment, it is impossible to determine the trustworthiness of CoC. As scientists, forensic examiners have a responsibility to reverse this tendency and officially confront the uncertainty inherent in any evidence upon which they base their judgments. To address these issues, this article proposes a new paradigm for ensuring the integrity of digital evidence (CoC documents). The new paradigm employs fuzzy hash within blockchain data structure to handle uncertainty introduced by error-prone tools when dealing with CoC documents. Traditional hashing techniques are designed to be sensitive to small input modifications and can only determine if the inputs are exactly the same or not. By comparing the similarity of two images, fuzzy hash functions can determine how different they are. With the symmetry idea at its core, the suggested framework effectively deals with random parameter probabilities, as shown in the development of the fuzzy hash segmentation function. We provide a case study for image forensics to illustrate the usefulness of this framework in introducing forensic preparedness to computer systems and enabling a more effective digital investigation procedure.

Improving Uncertainty in Chain of Custody for Image Forensics Investigation Applications

Cybercrime investigations rely heavily on digital evidence to establish links between suspects and the criminal conduct they are allegedly involved in. As a result, digital evidence must be protected since it is complex, volatile, and susceptible to alteration. In the digital evidence method, the chain of custody (CoC) is essential. As a result of the CoC, it is possible to establish that the evidence was never tampered with. Due to the inherent uncertainty of digital evidence, the trustworthiness of the CoC cannot be judged at this time. It is the duty of forensic examiners to challenge this inclination and publicly admit the inherent ambiguity in whatever evidence they use to make their decisions. This article suggests a new paradigm for maintaining the integrity of digital evidence in order to overcome these challenges. To handle the uncertainty generated by error-prone technologies while dealing with CoC documents, the new paradigm used a fuzzy hash inside the blockchain data structure. Traditional hashing methods are only able to tell whether two inputs are precisely the same or not because they are sensitive to even the smallest input changes. Using fuzzy hash functions, we can figure out how dissimilar two images are by comparing their similarities. As an example of how this paradigm may be applied to computer systems and make digital investigations more successful, we utilize image forensics as the focus of an in-depth look at how it works.

Maintaining and Evaluating the Integrity of Digital Evidence in Chain of Custody

The Chain of Custody is an intrinsic part of any inspection. Maintaining and evaluating the integrity of evidence procured from a crime scene is an important part that needs to be done properly by following a certain set of protocols to make the evidence admissible in the court. Keeping track of the evidence right from the moment it was collected from the crime scene till the time it reaches court is also a major task. It is important for the investigator to know how, where and who handles the evidence during analysis at each phase in order to safeguard the integrity of the evidence. Over a period of time, various tools and technologies have been created to handle evidence. Researchers from across the globe have presented various techniques on how evidence should be handled. Many researchers have even incorporated blockchain technology with the chain of custody or life cycle of evidence to make the process stronger. The growth in this domain has been at a rapid pace. This paper presents a method on “Maintaining and Evaluating the Integrity of a Digital Evidence in Chain of Custody” using a global positioning system. The methodology focuses on the use of global positioning system tags or chips which when embedded with the collected evidence enables an investigator to track the evidence throughout its life cycle. The proposed methodology aims to help the investigators to keep track of the evidence throughout its life cycle using very basic tools like FTK Imager and technology like a global positioning system.

Manajemen Pengelolaan Bukti Digital Untuk Meningkatkan Aksesibilitas Pada Masa Pandemi Covid-19

Covid-19 has a major impact on human life, including the process of managing digital evidence. Management of digital evidence requires special handling that can store and maintain the integrity of digital evidence. The current problem is there is no concept of storing digital evidence that can be accessed online in wider accessibility. Online digital evidence management is proposed as a solution to solve this problem. This concept is in the form of an online digital evidence management system that can be accessed anywhere and anytime using MD5 and SHA1 hash functions in order to maintain the properties of digital evidence so that it can be legally accepted. The problems with digital evidence management require a Management System for Digital Evidence that is suitable for application in Digital Forensics Laboratory. This research had successfully implemented the concept of online chain of custody. It is expected, with the concept of Online Digital Evidence Management, this digital evidence control and all activities related to it can be maintained and well documented. Moreover, it can reach a wider area accessed anywhere and any time and reduce the spread of Covid-19.

The Application of Blockchain of Custody in Criminal Investigation Process

With the advancing technologies become tools for illicit activities and avoid detection, digital forensics is necessary for law enforcement in modern criminal investigations. In order to maintain the integrity and authenticity of the evidence, a chain of custody is essential for the successful prosecution of criminals in court. However, it is a great challenge to manage the preservation and collection of digital evidence because of its fragile and volatile in nature. Blockchain has been proposed as a promising and reliable technology to provide immutability and traceability of digital content, however, the applications of blockchain to the law enforcement agencies (LEAs) requires special attention to the security issue. In this research, we proposed a blockchain of custody framework to facilitate the security and transparency of digital evidence in criminal investigation process. The framework is implement on Ethereum smart contract to support authenticity and integrity of digital evidence in preliminary investigation, case management and court phases. We also propose the role of investigator to leverage access control in evidence creation, transferring and modification. The corresponding actions with judicial process is simulated using private ethereum blockchain. The experimental results indicate that the proposed framework can prevent digital evidence been tampered or contaminated and assure its legal defensibility with rigorous privilege management. Moreover, by successfully synchronizing digital evidence transactions to multiple nodes ensures the accountability of evidence data for every involved law enforcement agency.

A DESIGN OF DIGITAL CHAIN CUSTODY FOR REPUBLIC OF IRAQ

Chain of custody (COC) is a concept and process designed to ensure the integrity of evidence including digital evidence (DE). Also, it defines a set of procedures to document files according to its chronological [1]. In this paper, the authors design a Chain of custody application software in order to document all digital evidence in order to ensure its integrity. Thus, a chain of custody application design to document the digital evidence from the time it collected to the time where the evidence actually presented at the court to ensure the digital evidence integrity and authenticity. It can help the investigator to follow clear documentation during the investigation process because of the conventional method considered a problematic issue when it used for digital evidence. In addition to physical evidence and digital evidence have different features and characteristics.The Chain of Custody application for digital evidence is designed using the SQL and XML [3] schema approach to save case information and compute DE hash value. then compare it with its value stores in the COC tab. This solution comes as one of the solutions to enrich the existing solution of the digital chain of custody.

Applying distributed ledger technology to digital evidence integrity

This paper examines the way in which blockchain technology can be used to improve the verification of integrity of evidence in digital forensics. Some background into digital forensic practices and blockchain technology are discussed to provide necessary context. A particular scalable method of verifying point-in-time existence of a piece of digital evidence, using the OpenTimestamps (OTS) service, is described, and tests are carried out to independently validate the claims made by the service. The results demonstrate that the OTS service is highly reliable with a zero false positive and false negative error rate for timestamp attestations, but that it is not suitable for timesensitive timestamping due to the variance of the accuracy of timestamps induced by block confirmation times in the Bitcoin blockchain.

Adoption of Chain of Custody Improves Digital Forensic Investigation Process

Chain of custody plays an important role in determine integrity of digital evidence, because the chain of custody works on a proof that evidence has not been altered or changed through all phases, and must include documentation on how evidence is gathered, transported, analyzed and presented.
 The aims of this work is first to find out how the chain of custody has been applied to a wide range of models of the digital forensic investigation process for more than ten years. Second, a review of the methods on digitally signing an evidence that achieves the successful implementation of chain of custody through answering a few questions "who, when, where, why, what and how", and thus providing digital evidence to be accepted by the court. Based on the defined aims an experimental environment is being setup to outline practically an acceptable method in chain of custody procedure. Therefore, we have adopted SHA512 for hashing and regarding encryption RSA and GnuGP is applied where according to the defined requirement a combination of this algorithms could be adopted as a practical method.

The Art of Piecewise Hashing: A StepToward Better Evidence Provability

The integrity of digital evidence is believed to be the paramount trait in the world of cyber forensics. Cybercrime investigators face myriad challenges in the process similar to accommodating the call for bulk digital evidence. In due course extraction of useful information while maintaining the integrity and absolute protection against data degradation is mandatory. In this manuscript, we propose a novel approach by applying cryptographic hashing technique to only selected significant portions of the digital evidence, so even if the overall hash does not match, investigators could still verify the integrity of those critical sections of the evidence.We put forward two notions in this manuscript; former is heterogeneous piecewise hashing which is a flexible version of the piecewise hashing strategy, and latter is a novel evidence certification strategy which formalizes evidence provability process completely.

A review of collisions in cryptographic hash function used in digital forensic tools

Digital forensic tool is a software used by digital evidence investigators to extract data and information from a digital evidence. The integrity of the digital evidence must be maintained through the chain of custody in order to be admissible in court. Most digital extraction tool use either MD5 (Message Digest) or SHA (Secured Hash Algorithm) hashing to check the integrity of digital evidence. The hashing algorithm has been found to have a weakness known as collision in which two different messages have the same hashing values. Although the probability of producing such weakness is very small, this collision can be used to deny the usage of the evidence in court of justice. After the first collision has been found, many cryptanalysts have tried to explore various methods to detect the collisions with shorter and efficient time. This paper is to review the existing methods in digital forensic tools that have been used to create a collision attacks in digital evidence.

Protecting Digital Evidence Integrity and Preserving Chain of Custody

Protecting Digital Evidence Integrity and Preserving Chain of Custody

Deleting collected digital evidence by exploiting a widely adopted hardware write blocker

In this primary work we call for the importance of integrating security testing into the process of testing digital forensic tools. We postulate that digital forensic tools are increasing in features (such as network imaging), becoming networkable, and are being proposed as forensic cloud services. This raises the need for testing the security of these tools, especially since digital evidence integrity is of paramount importance. At the time of conducting this work, little to no published anti-forensic research had focused on attacks against the forensic tools/process. We used the TD3, a popular, validated, touch screen disk duplicator and hardware write blocker with networking capabilities and designed an attack that corrupted the integrity of the destination drive (drive with the duplicated evidence) without the user's knowledge. By also modifying and repackaging the firmware update, we illustrated that a potential adversary is capable of leveraging a phishing attack scenario in order to fake digital forensic practitioners into updating the device with a malicious operating system. The same attack scenario may also be practiced by a disgruntled insider. The results also raise the question of whether security standards should be drafted and adopted by digital forensic tool makers.

Secure and Trusted Environment as a Strategy to Maintain the Integrity and Authenticity of Digital Evidence

The authenticity and the integrity of digital evidence are critical issues in digital forensics activities. Both aspects are directly related to the application of The Locard Exchange Principle (LEP), which is a basic principle of the existence of evidence in an event. This principle, not only applies before and at the time the event occurs, but also applies to the investigation process. In the handling of digital evidence, all activities to access the digital evidence are not likely to occur without the mediation of a set of instruments or applications, whereas every application is made possible for the existence of bugs. In addition, the presence of illegal access to the system, malicious software as well as vulnerabilities of a computer system are a number of potential problems that can have an impact on the change in the authenticity and the integrity of digital evidence. If this is the case, secure and trust characteristics that should appear in the activity of digital forensics may be reduced. This paper tries to discuss how the concept of a secure and trusted environment can be applied to maintain the authenticity and integrity of digital evidence. The proposed concept includes the unity of five components, namely standard and forensics policy, security policy, model and trusted management system, trusted computing, secure channel communication, and human factor. The ultimate purpose of this paper is to provide an overview of how the recommendation can be applied to meet the requirements of a secure and trusted environment in digital forensics for keeping the authenticity and the integrity of digital evidence. In general, this paper tends to explain a high-level concept and does not discuss low-level implementation of a secure and trusted environment.

Digital Chain of Custody: State of The Art

Digital forensics starts to show its role and contribution in the society as a solution in disclosure of cybercrime. The essential in digital forensics is chain of custody, which is an attempt to preserve the integrity of digital evidence as well as a procedure for performing documentation chronologically toward evidence. The characteristics of digital evidence have caused the handling chain of custody is becoming more complicated and complex. A number of researchers have contributed to provide solutions for the digital chain custody through a different point of views. This paper gives an overview of the extent to which the problem and challenges are faced in the digital chain of custody issue as well as the scope of researches that can be done to contribute in the issue of the digital chain of custody.

QQ Messenger chat record as criminal evidence in China

Minyan Wang sets out the facts of a case involving a QQ Messenger chat record and the part the messages played in proof of rape, including how admissibility, authentication and integrity of digital evidence is assessed in the criminal courts in China.