Secure Storage Model for Digital Forensic Readiness

Abstract

Securing digital evidence is a key factor that contributes to evidence admissibility during digital forensic investigations, particularly in establishing the chain of custody of digital evidence. However, not enough is done to ensure that the environment and access to the evidence are secure. Attackers can go to extreme lengths to cover up their tracks, which is a serious concern to digital forensics particularly digital forensic readiness. If an attacker gains access to the location where evidence is stored, they could easily alter the evidence (if not remove it altogether). Even though integrity checks can be performed to ensure that the evidence is sound, the collected evidence may contain sensitive information that an attacker can easily use for other forms of attack. To this end, this paper proposes a model for securely storing digital evidence captured pre-and post-incident to achieve reactive forensics. Various components were considered, such as integrity checks, environment sandboxing, strong encryption, twofactor authentication, as well as unique random file naming. A proof-of-concept tool was developed to realize this model and to prove its validity. A series of tests were conducted to check for system security, performance, and requirements validation, Overall, the results obtained showed that, with minimal effort, securing forensic artefacts is a relatively inexpensive and reliable feat. This paper aims to standardize evidence storage, practice high security standards, as well as remove the need to create new systems that achieve the same purpose.

An Integrated Checklist for Architecture Design of Critical Software Systems

“…We added categories to cover incident phases described in Section IV-C, i.e., Access Control, Anomaly Detection, Phenomenon Evaluation, Stopping from Propagating, Self-Adaptiveness, and Evidence. For each category, we went through existing studies and other sources [37], [38], [39], [40], [41], [42], [43], [44], [45], [46], [47], [48], [49], [50], [51], [52], [53], [54], [55], [56], [57] to examine the completeness of the coverage by the standards and complement the missing pieces. All these recommendations were again validated against our inclusion and exclusion criteria.…”

“…Evidence [33], [54] All evidence data are secured. Evidence, Encryption [56], [57] Evidence storage is reliable. Evidence [55] a) Access Control: Access control ensures that data cannot be changed or read by unauthorized entities.…”

A Novel Framework for Mobile Forensics Investigation Process

“…The SDCA [28] tool is designed to perform the analysis of the differences automatically between two versions of SQL schema, in addition to its ability to analyze the query. In [29]aid forensic investigation in general, by developing a model and a platform to secure potential digital evidence, the SecureRS model can help to prevent unauthorized access and comply with regulations and privacy policies, the result shows a method of ensuring forensically sound digital evidence for DFR as well as for digital forensics processes in general. In [7] the authors discussed the tools used to acquire the data from iOS or Android devices for both rooted and jailbreak mobile; the results have shown that the XRY software tool can recover deleted materials and can be able to extract all the data from the phone but it cannot retrieve deleted data for not jailbroken iPhone,…”

Forensic experts' view of forensic‐ready software systems: A qualitative study

“…It is also referred to as infrastructure readiness 21 . The addressed controls are aimed toward, for example, evidence storage 22,23 and evidence integrity 24 . In the latter, blockchain‐based solutions have gained prominence recently 25,26 .…”