Improving Uncertainty in Chain of Custody for Image Forensics Investigation Applications

Abstract

Digital evidence is critical in cybercrime investigations because it is used to connect individuals to illegal activity. Digital evidence is complicated, diffuse, volatile, and easily altered, and as such, it must be protected. The Chain of Custody (CoC) is a critical component of the digital evidence procedure. The aim of the CoC is to demonstrate that the evidence has not been tampered with at any point throughout the investigation. Because the uncertainty associated with digital evidence is not being assessed at the moment, it is impossible to determine the trustworthiness of CoC. As scientists, forensic examiners have a responsibility to reverse this tendency and officially confront the uncertainty inherent in any evidence upon which they base their judgments. To address these issues, this article proposes a new paradigm for ensuring the integrity of digital evidence (CoC documents). The new paradigm employed fuzzy hash within blockchain data structure to handle uncertainty introduced by errorprone tools when dealing with CoC documents. Traditional hashing techniques are designed to be sensitive to small input modifications and can only determine if the inputs are exactly the same or not. By comparing the similarity of two images, fuzzy hash functions can determine how different they are. We provide a case study for image forensics to illustrate the usefulness of this model in introducing forensic preparedness to computer systems and enabling a more effective digital investigation procedure.

ETHICore: Ethical Compliance and Oversight Framework for Digital Forensic Readiness

“…Maintaining a secure chain of custody-documenting every step of the evidence handling process from collection to presentation-is essential to demonstrate that the evidence has not been tampered with. This process can be technically challenging, especially when dealing with digital evidence that can be easily modified or corrupted [40][41][42][43][44][45][46][47][48].…”

A Survey of Forensic Analysis and Information Visualization Approach for Instant Messaging Applications

“…The hash value of each file item inside the evidence is computed, and known files are filtered for the freshly computed hash value data [18]. The file filtering technique is significant in forensically examining file systems, for example, examining file similarities, as in [19], and examining file types, as in [20]. A limitation of this technique, however, is that it cannot be applied to corrupted files.…”

A Comprehensive Analysis of the Role of Artificial Intelligence and Machine Learning in Modern Digital Forensics and Incident Response

“…The implementation of the tool would assist minor departments in eliminating the manual chain of custody process and storing information securely for an extended period without risk of modification. According to Elgohary et al (2022), the paper acknowledges the need for supplementary enhancements, such as adding a search engine and a data grouping feature, to facilitate access to information and patterns in similar cases. Overall, the research was successful in accomplishing its goal of developing a chain of custody data visualisation tool based on time.…”