Comparative Study and Analysis on Integrity of Data Files Using Different Tools and Techniques
محتوى المقال
الملخص
Digital forensic investigation is the scientific process of collection, preservation, examination, analysis, documentation and presentation of digital evidence from digital devices, so that the evidence is in compliance with legal terms and acceptable in a court of law. Integrity of the digital evidence is an indispensable part of the investigation process and should be preserved to maintain the chain of custody. This is done through hashing technique using standardized forensic tools. However, while handling the evidences , lack of knowledge might lead to unintentional alteration of computed hash. This violates the chain of custody and makes the evidence inadmissible in a court of law. In this paper, our objective is to determine the different conditions under which the original hash value of a digital evidence changes. For this, we create different scenarios using sample data files and compute their hash values. A comparative study and analysis are done to determine in which scenario the original hash value of the data file changes. The results of the research will prove useful and essential for Criminal Justice Functionaries in gaining knowledge about various conditions leading to the change in hash value of digital evidence and therefore, avoid its accidental alteration during forensic investigation/examination.
الكلمات المفتاحية
Integrity، Hash Values، Digital Forensics، Digital Evidence، Evidence Samples، Metadata، OSForensics، WinHex
التنزيلات
المراجع
R. Kissel, “Glossary of Key Information Security Terms,” National Institute of Standards and Technology, Gaithersburg, MD, USA, Rep. no. 7298 Rev. 2, NIST Interagency/Internal Report (NISTIR). [Online]Available: https://doi.org/10.6028/NIST.IR.7298r2
T. Grance, S. Chevalier, K. K. Scarfone and Hung Dang, “Guide to Integrating Forensic Technique into Incident Response,” National Institute of Standards and Technology, Gaithersburg, MD, USA, Rep. no. 800-86, Special Publication (NIST SP). [Online]Available: https://tsapps.nist.gov/publication/get_pdf.cfm?pub_id=50875
C. Hosmer, “Proving the Integrity of Digital Evidence with Time,” Int. J. Digit. Evid. vol. 1, no. 1, pp. 1-7, 2002.
K. Raychaudhuri, “A Comparative Study of Analysis and Extraction of Digital Forensic Evidences from Exhibits using Disk Forensic Tools,” Int. J. Cyber-Secur. Digit. Forensics, vol. 8, no. 3, pp. 194-205, Sep. 2019, doi: 10.17781/P002608.
J. Williams, ACPO Good Practice Guide for Digital Evidence, Version 5.0, (2012). [Online] Available: https://www.digital-detective.net/digital-forensics-documents/ACPO_Good_Practice_Guide_for_Digital_Evidence_v5.pdf
A. Menezes, P. C. Oorschot and S. Vanstone, Handbook of Applied Cryptography, Boca Raton, FL, USA: CRC Press, 1997.
K. Raychaudhuri and M. G. Christopher, “An Empirical study to determine the role of file-system in modification of hash value,” Int. J. Cybersecur. Intell. Cybercrime, vol. 3, no. 1, pp. 24-41, Feb. 2020.
J. Ćosić and M. Bača, "(Im)proving chain of custody and digital evidence integrity with time stamp," In 33rd Int. Conv. MIPRO, Croatia, 2010, pp. 1226-1230.
J. R. Vacca, Computer Crime Scene Investigation, Boston, MA, USA: Charles River Creative, 2002.
J. Richter, N. Kuntze and C. Rudolph, "Security Digital Evidence," in 2010 Fifth IEEE Int. Workshop Syst. Approaches Digit. Forensic Eng., USA, 2010, pp. 119-130, doi: 10.1109/SADFE.2010.31.
K. Kumar, S. Sofai, S.K. Jain and N. Aggarwal, “Significance of Hash Value Generation in Digital Forensic: A Case Study,” Int. J. Eng. Res. Dev., vol. 2, no. 5, pp. 64-70, July 2012.
V. Roussev, "Hashing and Data Fingerprinting in Digital Forensics," IEEE Secur. Priv., vol. 7, no. 2, pp. 49-55, March-April 2009, doi: 10.1109/MSP.2009.40.
R. Rivest, The DS5 Message-Digest Algorithm, (1992). Accessed: Jan. 20. [Online]Available: https://www.ietf.org/rfc/rfc1321.txt
R. Chaves, et al. “Secure Hashing: SHA-1, SHA-2, and SHA-3,” in Circuits and Systems for Security and Privacy, F. Sheikh and L. Sousa, Ed, Boca Raton, FL, USA: CRC Press, 2018, p. 382.
Secure Hash Standard (SHS): Federal Information Processing Standards Publication, FIPS PUB 180-4, National Institute of Standards and Technology, MD, USA. 2012.
G. C. Kessler, “A Study of Forensic Imaging in the Absence of Write-Blockers,” J. Digit. Forensic Secur. Law, vol. 9, no. 3, pp. 51-58, 2014, doi: 10.15394/jdfsl.2014.1187
NIST, “Computer Forensics Tools & Techniques Catalog”. Accessed: Dec. 21. [Online]Available: https://toolcatalog.nist.gov/
OSForensics 8.0, PassMark Software. Accessed: Dec. 20. [Online]Available: https://www.osforensics.com/
WinHex: Computer Forensics & Data Recovery Software, Hex Editor & Disk Editor, X-Ways. Accessed: Dec. 15. [Online]Available: https://x-ways.net/winhex/
Craigball, “A Hash of It,” Mar. 2012. Accessed: Dec. 10. [Online]Available: https://craigball.net/2012/03/05/
K. A. Schuler, E-discovery: Creating and Managing an Enterprisewide Program: A Technical Guide to Digital Investigation and Litigation Support, Burlington, MA, USA: Syngress Media, 2008.
Lossless Compression: An Overview. Accessed: Dec. 8. [Online]Available: https://cs.stanford.edu/people/eroberts/courses/soco/projects/data-compression/lossless/index.htm
Dose the MD5 change from encryption?. Accessed: Dec. 5. {online]Available: https://stackoverflow.com/questions/21467727/does-the-md5-change-from-encryption.
تفاصيل المقال
هذا العمل مرخص بموجب Creative Commons Attribution-NonCommercial 4.0 International License.