A Procedure for Tracing Chain of Custody in Digital Image Forensics: A Paradigm Based on Grey Hash and Blockchain

Abstract

Digital evidence is critical in cybercrime investigations because it is used to connect individuals to illegal activity. Digital evidence is complicated, diffuse, volatile, and easily altered, and as such, it must be protected. The Chain of Custody (CoC) is a critical component of the digital evidence procedure. The aim of the CoC is to demonstrate that the evidence has not been tampered with at any point throughout the investigation. Because the uncertainty associated with digital evidence is not being assessed at the moment, it is impossible to determine the trustworthiness of CoC. As scientists, forensic examiners have a responsibility to reverse this tendency and officially confront the uncertainty inherent in any evidence upon which they base their judgments. To address these issues, this article proposes a new paradigm for ensuring the integrity of digital evidence (CoC documents). The new paradigm employs fuzzy hash within blockchain data structure to handle uncertainty introduced by error-prone tools when dealing with CoC documents. Traditional hashing techniques are designed to be sensitive to small input modifications and can only determine if the inputs are exactly the same or not. By comparing the similarity of two images, fuzzy hash functions can determine how different they are. With the symmetry idea at its core, the suggested framework effectively deals with random parameter probabilities, as shown in the development of the fuzzy hash segmentation function. We provide a case study for image forensics to illustrate the usefulness of this framework in introducing forensic preparedness to computer systems and enabling a more effective digital investigation procedure.

ForensicTransMonitor: A Comprehensive Blockchain Approach to Reinvent Digital Forensics and Evidence Management

“…First is the integration of blockchain technology into cloud forensics, offering methods and architectures that enhance the credibility, effectiveness, and security of forensic investigations in digital environments mostly related to the chain of custody (CoC). The central focus of [3][4][5][6][7][8][9][10][11][12][13][14][15] was the utilization of blockchain technology for ensuring the integrity, traceability, and privacy of digital evidence and CoC in digital forensics. Some of the solutions for specific use cases such as image forensics, healthcare, and finance were generally discussed, as well as blockchain integration with computer forensics in the context of CoC.…”

“…Some of the solutions for specific use cases such as image forensics, healthcare, and finance were generally discussed, as well as blockchain integration with computer forensics in the context of CoC. Ali et al [3] introduced a novel technique that integrates fuzzy hashing within blockchain structures, primarily used for image forensics. Both Yan et al [4] and Silva et al [5] presented frameworks based on blockchain technology that emphasize the importance of traceability and integrity in the chain of custody.…”

Using Blockchain to Preserve Chain of Custody: Cloud Forensics Analysis (S)

“…In [23], the authors suggest standardising smart contracts for a secure and reliable chain of custody process, but note that a holistic approach, including robust evidence and participant management, is necessary. The work in [24] evaluates the effectiveness of fuzzy hashing algorithms in preserving the integrity of digital evidence in image forensics compared to conventional cryptographic hash algorithms, showing that fuzzy hash-based blockchain effectively supports the chain of custody process.…”

A Bibliometric Analysis and Systematic Review of a Blockchain-Based Chain of Custody for Digital Evidence

“…Chain of custody is often a problem when dealing with digital evidence. The chain of custody plays a crucial role in digital forensic investigations by keeping track of every detail of digital evidence as it passes through different organisational levels [5]. Metadata on the method, time, place, and people who handled the data during its acquisition, processing, storage, and eventual use in investigations are all recorded by chain of custody.…”