Blockchain Based digital forensics for Evidence Collection and Provenance Preservation

Abstract: Digital evidence is very important in investigating cybercrime and other security-related incidents. However, protecting digital evidence from unauthorized changes and maintaining a clear record of its handling can be difficult. Evidence may pass through several investigators or organizations during an investigation, making it necessary to keep accurate records of how it is collected, transferred, stored, and examined.

This research proposes a blockchain-based framework for collecting digital evidence and maintaining its history securely. The framework uses a permissioned blockchain to record important activities related to digital evidence. Cryptographic hash values help verify whether the evidence has been modified, while blockchain maintains a chronological record of evidence collection, access, transfer, and verification. Only authorized investigators and administrators are permitted to perform specific operations. The original evidence files are stored in a secure external storage system, while the blockchain maintains their related information and integrity records.

The proposed framework aims to make digital forensic investigations more transparent, secure, and accountable. It helps investigators track the movement of evidence and identify unauthorized changes. The design also considers challenges such as data privacy, storage requirements, transaction speed, and the need for proper evidence collection procedures. Overall, this framework provides a foundation for improving digital evidence management and preserving the reliability of evidence throughout the forensic investigation process.

Keywords: Blockchain, Digital Forensics, Digital Evidence, Evidence Preservation, Cryptographic Hash, Chain of Custody.