Blockchain-Based Digital Forensics Investigation Framework in the Internet of Things and Social Systems

TLDR

Blockchain’s decentralization supports integrity and provenance of digital forensic evidence across jurisdictional borders. The paper proposes a blockchain‑based digital forensics framework for IoT and social systems that provides proof of existence and preserves privacy of evidence. The IoT forensic chain (IoTFC) records evidence identification, preservation, analysis, and presentation in block chains, offering authenticity, immutability, traceability, resilience, and distributed trust between evidential entities and examiners. The IoTFC guarantees traceability and provenance of evidence, increases trust through audit transparency, and its use case demonstrates effectiveness.

Abstract

The decentralized nature of blockchain technologies can well match the needs of integrity and provenances of evidences collecting in digital forensics (DF) across jurisdictional borders. In this paper, a novel blockchain-based DF investigation framework in the Internet of Things (IoT) and social systems environment is proposed, which can provide proof of existence and privacy preservation for evidence items examination. To implement such features, we present a block-enabled forensics framework for IoT, namely, IoT forensic chain (IoTFC), which can offer forensic investigation with good authenticity, immutability, traceability, resilience, and distributed trust between evidential entitles as well as examiners. The IoTFC can deliver a guarantee of traceability and track provenance of evidence items. Details of evidence identification, preservation, analysis, and presentation will be recorded in chains of block. The IoTFC can increase trust of both evidence items and examiners by providing transparency of the audit train. The use case demonstrated the effectiveness of the proposed method.