Chronological independently veri fiable electronic chain of custody ledger using blockchain technology

As evidence in digital form becomes more prevalent in all kinds of investigations, there is a pressing need for a trustworthy and transparent way to maintain electronic chain of custody (e-CoC) and integrity information that is independently veri fiable. Generally, a hash value of digital evidence is calculated and documented with the acquired data to prove that it has not been altered. However, the hash value alone does not prove that digital evidence is the same as when it was obtained, only that the contents has not been modi fied since the time when the hash was calculated. This work responds to the need for a chronological independently veri fiable e-CoC ledger using blockchain technology. Employing this approach, each e-CoC record is stored in a block, each block being connected to the previous one with the hash value of the block. This e-CoC ledger, the blockchain, can be hosted by a trusted entity and accessed by any party to verify e-CoC details. For privacy reasons, sensitive information is not stored inside the e- CoC record in the blockchain. Moreover, to prove that the e-CoC ledger itself has not been modi fied, information is periodically sent to a public blockchain, where the integrity is guaranteed by its decen- tralization and the structure of such a secure ledger. Not all of the blocks are sent into a public blockchain which allows different levels of veri fication. Proof -of -work examples are provided using AFF4 and dc3dd to demonstrate how this e-CoC ledger can be used by different parties in a legal context, including digital forensic practitioners, attorneys and judges. (C) 2020 Elsevier Ltd. All rights reserved.