A Framework of Darknet Forensics

Leng, Tao; Yu, Aimin

doi:10.1145/3503047.3503082

Cited by 7 publications

(4 citation statements)

References 6 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This method can assist in determining if the vendor has overtly sold fentanyl in the past and allow investigators to gauge whether it is probable that they have shifted to covert listings using code words. Moreover, the eventual seizure and forensic disk examination of computer equipment from fentanyl vendors are of high value, can confirm Tor browsing [94] and DNM activity [95], and data can be matched to databases compiled from the data scraping. This comparison allows law enforcement to link specific PGP encryption keys to specific dealers, allowing attribution of the dealers' volume and variety of drug listings, via their involvement in a specific DNM.…”

Section: Discussionmentioning

confidence: 99%

Decoding hidden darknet networks: What we learned about the illicit fentanyl trade on AlphaBay

Maras

Logie

Arsovska

et al. 2023

Journal of Forensic Sciences

View full text Add to dashboard Cite

The opioid epidemic, impacted from the proliferation of fentanyl, has added impetus to the need to detect fentanyl, sources of fentanyl, and places where fentanyl and drugs adulterated with fentanyl are available. Many darknet marketplaces (DNMs) have rules that ban fentanyl. However, it is unclear how these affect the fentanyl market. Using the AlphaBay DNM as a case study, we conducted mixed methods qualitative research. We scraped and analyzed data from the AlphaBay I2P website using, among other methods, content and social network analysis, to uncover hidden fentanyl networks. Our research highlights the next evolution of darknet marketplaces – the migration of DNMs from Tor to I2P and the methods that can be used identify fentanyl networks, irrespective of where sites are: I2P, Tor, or multihomed on I2P and Tor. Despite its ban in the Global AlphaBay Rules, our research revealed the sale of fentanyl on the AlphaBay DNM. Unlike previous studies, our findings predominantly revealed the covert sale of fentanyl on AlphaBay and predatory vendors selling illicit drugs, which unbeknownst to buyers, contained fentanyl. To a lesser extent, our findings identified the overt sale of fentanyl patches on AlphaBay. Although we examined only one DNM, the prevalence of the covert sale of fentanyl and the presence of predatory vendors underscores the importance of research that decodes the language of vendors who surreptitiously sell fentanyl or drugs adulterated with fentanyl or other illicit substances. The results of our research can inform strategies aimed at disrupting and dismantling DNM fentanyl networks.

show abstract

Section: Discussionmentioning

confidence: 99%

Decoding hidden darknet networks: What we learned about the illicit fentanyl trade on AlphaBay

Maras

Logie

Arsovska

et al. 2023

Journal of Forensic Sciences

View full text Add to dashboard Cite

show abstract

“…However, some have made an effort to map this out. According to [2,14] research journals, browser forensic examinations focus on performing more conventional operations on the computer, such as database, RAM, network forensics, and registry. In contrast, dark web forensics should consolidate two fundamental areas: forensics connected to TOR activities and forensics linked to Bitcoin transactions [16].…”

Section: The Landscape Of Dark and Deep Web Forensicsmentioning

confidence: 99%

“…In contrast to the previous report, which was not simple, the entire report has numerous figures and tables that demonstrate the tests being conducted. The most helpful report was found as a result of this; it was a doctoral dissertation submitted to Dakota State University which focused on finding any dark web artefacts on a machine and creating a framework around this [14]. The depth of information in the report extends beyond the scope of this one.…”

Section: Browsing Artefactsmentioning

confidence: 99%

“…In addition, the Invisible Internet Project (I2P) is an unknown peer-to-peer network layer that uses layered encryption and garlic routing, a variant of onion routing, to ensure the anonymity of communications [13]. The new generation of anonymity and privacy browsers, such as TOR and I2P, rely on a complex implementation of the onion routing topology initially introduced by the US Navy Research Lab in the mid-1990s to conceal the user's IP address [14]. As a result, attempts to trace or identify the user online by relying on traffic capture are nearly impossible.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

D2WFP: A Novel Protocol for Forensically Identifying, Extracting, and Analysing Deep and Dark Web Browsing Activities

Ghanem,

Mulvihill,

Ouazzane

et al. 2023

JCP

View full text Add to dashboard Cite

The use of the unindexed web, commonly known as the deep web and dark web, to commit or facilitate criminal activity has drastically increased over the past decade. The dark web is a dangerous place where all kinds of criminal activities take place, Despite advances in web forensic techniques, tools, and methodologies, few studies have formally tackled dark and deep web forensics and the technical differences in terms of investigative techniques and artefact identification and extraction. This study proposes a novel and comprehensive protocol to guide and assist digital forensic professionals in investigating crimes committed on or via the deep and dark web. The protocol, named D2WFP, establishes a new sequential approach for performing investigative activities by observing the order of volatility and implementing a systemic approach covering all browsing-related hives and artefacts which ultimately resulted in improving the accuracy and effectiveness. Rigorous quantitative and qualitative research has been conducted by assessing the D2WFP following a scientifically sound and comprehensive process in different scenarios and the obtained results show an apparent increase in the number of artefacts recovered when adopting the D2WFP which outperforms any current industry or opensource browsing forensic tools. The second contribution of the D2WFP is the robust formulation of artefact correlation and cross-validation within the D2WFP which enables digital forensic professionals to better document and structure their analysis of host-based deep and dark web browsing artefacts.

show abstract