Digital Evidence Cabinets: A Proposed Framework for Handling Digital Chain of Custody

Abstract

Chain of custody is the procedure to do a chronological documentation of evidence, and it is an important procedure in the investigation process. Both physical and digital evidence is an important part in the process of investigation and courtroom. However, handling the chain of custody for digital evidence is more difficult than the handling of physical evidence. Nevertheless, the handling of digital evidence should still have the same procedure with the handling of physical evidence. Until now handling the chain of custody for digital evidence is still an open problem with a number of challenges, including the business model of the interaction of the parties that deal with digital evidence, recording of metadata information as well as issues of access control and security for all the handling digital chain of custody. The solution offered in this research is to build a model of Digital Evidence Cabinets as a new approach in implementing the digital evidence handling and chain of custody. The model is constructed through three approaches: Digital Evidence Management Frameworks, Digital Evidence Bags with Tag Cabinets as well as access control and secure communication. The proposed framework is expected to be a solution for the availability of an environment handling of digital evidence and to improve the integrity and credibility of digital evidence.

XML Approach for the Solution of Chain of Custody of Digital Evidence

“…While for digital evidence there are a number of solutions provided by other researchers such as the business model of digital evidence handling [4], the creation of a digital proofread chain of custody framework with the digital cabinet concept [6], the framework of the chain of custody process of digital evidence investigation [7], the description of the information needs of chain of custody management using the ontology approach [8] [9], the concept of digital evidence bag that mimics the function of a plastic bag of evidence by using an XML document type [10] and others.…”

“…The process or method of acquisition to produce the digital evidence file are also from an online and offline acquisition. This architecture was inspired based on a digital forensic handling business practice model on digital evidence using a digital cabinet approach as a repository of digital evidence file [6].…”

Secure and Trusted Environment as a Strategy to Maintain the Integrity and Authenticity of Digital Evidence

“…In principle, [10] argues that cybercrime is a criminal activity where a computer or computer network is used as the primary means to violate prevailing law, rules, or regulations. Data and survey from PwC and RSA cited by Prayudi [7] show that cybercrime is a serious threat to individuals, institutions or countries and the amount of losses globally could be compared to the national income of a country.…”

“…Digital evidence has a number of characteristics; it is easy to duplicate and transmitted, very susceptible to modify and to remove, easily contaminated by new data, and time-sensitive [7]. According to Schatz that cited in [6], in contrast to physical evidence, digital evidence is very dependent on the interpretation of its content.…”

Digital Chain of Custody: State of The Art

“…Therefore, one research area for digital chain of custody is to provide a more comprehensive solution through unity in the existing solution and the concept of business model, the concept of record and storing information, as well as security and access control. This is what underlies [55] to propose a solution known as Digital Evidence Cabinets. The solution offered is like a new approach to dealing with digital evidence and documentation of a digital chain of custody.…”