Blockchain Forensics: A Systematic Literature Review of Techniques, Applications, Challenges, and Future Directions
Abstract
:1. Introduction
- Investigating and reviewing recent and state-of-the-art studies on blockchain forensics by highlighting the merits and limitations of each study.
- Identifying diverse digital forensic investigation frameworks and methodologies used in blockchain forensics.
- Determining common applications of blockchain-based digital forensic investigation frameworks across various domains.
- Identifying legal and regulatory challenges encountered in conducting forensic investigations on blockchain systems.
- Presenting open issues and future research directions of blockchain forensics.
2. An Overview of Blockchain Forensics
2.1. Blockchain Technology
2.2. Digital Forensics
- Identification: This initial phase involves recognizing and determining the specific types of digital evidence relevant to the investigation. It requires a detailed understanding of the case to identify relevant digital artefacts, which may include files, metadata, logs, or communication records.
- Collection: Once the evidence has been identified, the collection phase focuses on the systematic gathering of digital evidence from the crime scene or relevant sources. This involves securing and documenting the devices or media, such as computers, smartphones, or servers, to ensure that no data are altered or lost during the process. Proper procedures, including using write-blockers and ensuring chain-of-custody documentation, are crucial to maintaining the integrity of the evidence.
- Extraction: During the extraction phase, the digital investigator retrieves the data from the identified devices. This may involve creating forensic images or copies of hard drives, memory cards, or other storage media. The aim is to extract relevant data while preserving the original evidence intact. Extraction often requires specialized tools and techniques to handle encrypted or damaged files and to ensure that all potentially relevant information is obtained.
- Analysis: In the analysis phase, the extracted data are examined in detail to uncover meaningful information. This involves interpreting file structures, recovering deleted files, analysing log entries, and correlating data across different sources. The goal is to identify patterns, connections, and anomalies that can support or disprove the claims made in the investigation. This phase often requires deep technical expertise and may involve reconstructing events or understanding complex data relationships.
- Examination: The examination phase is where the investigator carefully scrutinizes the features of the digital evidence. This involves verifying the authenticity of the data, validating findings through repeated tests, and ensuring that all aspects of the evidence are thoroughly explored. The examination phase aims to provide a detailed and accurate representation of the evidence, ensuring that all relevant details are considered.
- Report: The final phase involves compiling and presenting the findings in a comprehensive report. This report summarizes the investigative process, methodologies employed, and the conclusions drawn from the analysis and examination. It must be clear, detailed, and structured in a way that is understandable to non-technical audiences, including legal professionals and court personnel. The report plays a critical role in legal proceedings, providing evidence that is both admissible and persuasive in court.
2.3. Blockchain Forensics
- Identification: The first step in a blockchain forensic investigation is identifying the relevant data that needs to be examined. This involves determining the specific blockchain platform involved (e.g., Bitcoin and Ethereum), identifying relevant addresses, transactions, and smart contracts, and understanding the nature of the suspected illegal activity. The goal is to identify the exact data on the blockchain that is relevant to the investigation. For instance, studies have shown the importance of identifying specific addresses and transactions linked to criminal activities such as money laundering or ransomware payments.
- Collection: In the collection phase, investigators gather the identified data from the blockchain. This includes downloading the entire blockchain or extracting specific blocks, transactions, or addresses of interest. Given the public nature of most blockchains, these data are typically accessible without a warrant. However, the process must ensure that data are collected in a manner that preserves its integrity and authenticity. Advanced tools and techniques, such as blockchain explorers and forensic software, are often used to facilitate this process.
- Preservation: Preservation involves maintaining the integrity of the collected data to ensure they remain unchanged and reliable throughout the investigation. This includes creating cryptographic hashes of the data and securely storing them in a manner that prevents tampering. Blockchain’s inherent immutability aids in this process, but proper handling and documentation are still essential to uphold evidentiary standards in legal contexts.
- Analysis: The analysis phase is where investigators explore the collected data to uncover meaningful patterns, relationships, and anomalies. This may involve tracking the flow of cryptocurrencies, analysing transaction histories, and identifying links between blockchain addresses and real-world identities. Sophisticated analytical tools and techniques, such as clustering algorithms and graph analysis, are employed to make sense of the complex and often pseudonymous data on the blockchain.
- Examination: During this phase, investigators contextualize their findings within the broader scope of the investigation. This includes correlating blockchain data with external sources of information, such as IP logs, email records, or traditional financial records. The goal is to build a coherent narrative that explains how the blockchain data fit into the overall case and supports the allegations being investigated.
- Report: The final phase involves compiling the analysis and interpretation into a comprehensive report that can be presented in legal or regulatory settings. This report must clearly explain the methods used, the findings, and their significance, making it understandable for non-technical stakeholders such as lawyers, judges, and juries. Proper documentation and expert testimony are often required to validate the findings and ensure their admissibility in court.
3. Research Methodology
3.1. Research Questions
- RQ1: What are the state-of-the-art studies related to blockchain forensics and blockchain-based solutions for digital forensics?
- RQ2: How can blockchain technology enhance digital forensic investigations?
- RQ3: What are the digital forensic frameworks and methodologies used in blockchain forensics?
- RQ4: What are the common applications of blockchain-based digital forensic investigation frameworks?
- RQ5: What are the legal and regulatory challenges in conducting a forensic investigation on blockchain systems?
3.2. Inclusion and Exclusion Criteria
- Peer-reviewed journals and conference articles to ensure high-quality and credible sources;
- Relevant to the specific research questions;
- Topic mainly on blockchain forensics and blockchain-based forensic solutions;
- Full and available articles to allow for a comprehensive review of the content;
- English-language articles to maintain consistency in analysis.
- Articles concerning all other security aspects of blockchain apart from digital forensic investigations;
- Articles not focused on blockchain forensics or significantly deviating from the primary research questions;
- Unpublished articles, non-peer-reviewed articles, and editorial articles to ensure credibility;
- Articles that are not fully available;
- Non-English articles to avoid translation issues and maintain analysis consistency;
- Duplicates of already included articles to avoid redundancy.
3.3. Data Sources
- IEEE Xplore;
- PubMed;
- Elsevier ScienceDirect;
- Google Scholar;
- ACM Digital Library;
- SpringerLink.
- Blockchain forensic investigation;
- Blockchain forensics;
- Digital forensics in blockchain;
- Cryptocurrency forensics;
- Forensic techniques in blockchain;
- Investigating blockchain transactions;
- Blockchain tracing;
- Blockchain evidence collection;
- Forensic challenges in blockchain;
- Legal aspects of blockchain forensics;
- Blockchain forensic tools;
- Cryptocurrency crime investigation;
- Blockchain fraud detection.
3.4. Selection of Relevant Articles
- Phase 1: Publications found during the search and those already in the collection were sorted using the inclusion and exclusion criteria. The scope of the search was narrowed to include only articles published recently and consider the topic of blockchain forensics.
- Phase 2: The titles and abstracts of the articles collected from several digital libraries were reviewed to determine how well they addressed the topic and the questions posed in this research work.
- Phase 3: During this stage, we focused on eliminating duplicates among the six digital libraries used for our publication collection.
4. Analysis of Results
5. Results and Discussion
- IoT Forensics
- 2.
- Cloud Forensics
- 3.
- Vehicular Forensics
- 4.
- Mobile Forensics
- 5.
- Multimedia Forensics
- 6.
- Internet Voting Systems
- 7.
- Dark Web
6. Open Issues and Future Directions
6.1. Lack of Standardization
6.2. Regulatory and Legal Issues
6.3. Scalability Challenges
6.4. Applicability of Blockchain Forensic Frameworks
6.5. Integration of AI and ML in Blockchain Forensics
6.6. Education and Training
7. Conclusions
Author Contributions
Funding
Data Availability Statement
Conflicts of Interest
References
- Cebe, M.; Erdin, E.; Akkaya, K.; Aksu, H.; Uluagac, S. Block4Forensic: An Integrated Lightweight Blockchain Framework for Forensics Applications of Connected Vehicles. IEEE Commun. Mag. 2018, 56, 50–57. [Google Scholar] [CrossRef]
- Akanfe, O.; Lawong, D.; Rao, H.R. Blockchain technology and privacy regulation: Reviewing frictions and synthesizing opportunities. Int. J. Inf. Manag. 2024, 76, 102753. [Google Scholar] [CrossRef]
- Conti, M.; Kumar, G.; Lal, C.; Saha, R. Blockchain-Based Distributed and Secure Digital Forensic Investigation Systems. In Blockchains: A Handbook on Fundamentals, Platforms and Applications; Ruj, S., Kanhere, S.S., Conti, M., Eds.; Springer International Publishing: Cham, Switzerland, 2024; pp. 337–362. ISBN 978-3-031-32146-7. [Google Scholar]
- Atlam, H.F.; Wills, G.B. Technical aspects of blockchain and IoT. In Advances in Computers; Kim, S., Deka, G.C., Zhang, P., Eds.; Role of Blockchain Technology in IoT Applications; Elsevier: Amsterdam, The Netherlands, 2019; Volume 115, pp. 1–39. [Google Scholar]
- Mercan, S.; Cebe, M.; Aygun, R.S.; Akkaya, K.; Toussaint, E.; Danko, D. Blockchain-based video forensics and integrity verification framework for wireless Internet-of-Things devices. Secur. Priv. 2021, 4, e143. [Google Scholar] [CrossRef]
- Xiao, N.; Wang, Z.; Sun, X.; Miao, J. A novel blockchain-based digital forensics framework for preserving evidence and enabling investigation in industrial Internet of Things. Alex. Eng. J. 2024, 86, 631–643. [Google Scholar] [CrossRef]
- Li, S.; Qin, T.; Min, G. Blockchain-Based Digital Forensics Investigation Framework in the Internet of Things and Social Systems. IEEE Trans. Comput. Soc. Syst. 2019, 6, 1433–1441. [Google Scholar] [CrossRef]
- Dasaklis, T.K.; Casino, F.; Patsakis, C. SoK: Blockchain Solutions for Forensics. arXiv 2020, arXiv:2005.12640. [Google Scholar]
- Page, M.J.; McKenzie, J.E.; Bossuyt, P.M.; Boutron, I.; Hoffmann, T.C.; Mulrow, C.D.; Shamseer, L.; Tetzlaff, J.M.; Akl, E.A.; Brennan, S.E.; et al. The PRISMA 2020 statement: An updated guideline for reporting systematic reviews. BMJ 2021, 372, n71. [Google Scholar] [CrossRef]
- Jena, S.K.; Barik, R.C.; Priyadarshini, R. A systematic state-of-art review on digital identity challenges with solutions using conjugation of IOT and blockchain in healthcare. Internet Things 2024, 25, 101111. [Google Scholar] [CrossRef]
- Atlam, H.F.; Azad, M.A.; Alzahrani, A.G.; Wills, G. A Review of Blockchain in Internet of Things and AI. Big Data Cogn. Comput. 2020, 4, 28. [Google Scholar] [CrossRef]
- Atlam, H.F.; Alenezi, A.; Alassafi, M.O.; Wills, G.B. Blockchain with Internet of Things: Benefits, Challenges, and Future Directions. Int. J. Intell. Syst. Appl. 2018, 10, 40. [Google Scholar] [CrossRef]
- Atlam, H.F.; Wills, G.B. Intersections between IoT and distributed ledger. In Advances in Computers; Kim, S., Deka, G.C., Zhang, P., Eds.; Role of Blockchain Technology in IoT Applications; Elsevier: Amsterdam, The Netherlands, 2019; Volume 115, pp. 73–113. [Google Scholar]
- Indrason, N.; Saha, G. Exploring Blockchain-driven security in SDN-based IoT networks. J. Netw. Comput. Appl. 2024, 224, 103838. [Google Scholar] [CrossRef]
- Choi, W.; Woo, J.; Hong, J.W. Fractional non-fungible tokens: Overview, evaluation, marketplaces, and challenges. Int. J. Netw. Manag. 2024, 34, e2260. [Google Scholar] [CrossRef]
- Garfinkel, S.L. Digital forensics research: The next 10 years. Digit. Investig. 2010, 7, S64–S73. [Google Scholar] [CrossRef]
- Atlam, H.F.; Alenezi, A.; Alassafi, M.O.; Alshdadi, A.A.; Wills, G.B. Security, Cybercrime and Digital Forensics for IoT. In Principles of Internet of Things (IoT) Ecosystem: Insight Paradigm; Peng, S.-L., Pal, S., Huang, L., Eds.; Springer International Publishing: Cham, Switzerland, 2020; pp. 551–577. ISBN 978-3-030-33596-0. [Google Scholar]
- Atlam, H.F.; El-Din Hemdan, E.; Alenezi, A.; Alassafi, M.O.; Wills, G.B. Internet of Things Forensics: A Review. Internet Things 2020, 11, 100220. [Google Scholar] [CrossRef]
- Kumar, G.; Saha, R.; Lal, C.; Conti, M. Internet-of-Forensic (IoF): A blockchain based digital forensics framework for IoT applications. Future Gener. Comput. Syst. 2021, 120, 13–25. [Google Scholar] [CrossRef]
- Casino, F.; Dasaklis, T.K.; Patsakis, C. A systematic literature review of blockchain-based applications: Current status, classification and open issues. Telemat. Inform. 2019, 36, 55–81. [Google Scholar] [CrossRef]
- Aswal, P. Blockchain Nodes-Blockchain Council. Available online: https://www.blockchain-council.org/blockchain/blockchain-nodes/ (accessed on 26 August 2024).
- Haque, E.U.; Shah, A.; Iqbal, J.; Ullah, S.S.; Alroobaea, R.; Hussain, S. A scalable blockchain based framework for efficient IoT data management using lightweight consensus. Sci. Rep. 2024, 14, 7841. [Google Scholar] [CrossRef]
- Liberati, A.; Altman, D.G.; Tetzlaff, J.; Mulrow, C.; Gøtzsche, P.C.; Ioannidis, J.P.A.; Clarke, M.; Devereaux, P.J.; Kleijnen, J.; Moher, D. The PRISMA statement for reporting systematic reviews and meta-analyses of studies that evaluate healthcare interventions: Explanation and elaboration. BMJ 2009, 339, b2700. [Google Scholar] [CrossRef]
- Akinbi, A.; MacDermott, Á.; Ismael, A.M. A systematic literature review of blockchain-based Internet of Things (IoT) forensic investigation process models. Forensic Sci. Int. Digit. Investig. 2022, 42–43, 301470. [Google Scholar] [CrossRef]
- Atlam, H.F.; Oluwatimilehin, O. Business Email Compromise Phishing Detection Based on Machine Learning: A Systematic Literature Review. Electronics 2023, 12, 42. [Google Scholar] [CrossRef]
- Atlam, H.F.; Azad, M.A.; Alassafi, M.O.; Alshdadi, A.A.; Alenezi, A. Risk-Based Access Control Model: A Systematic Literature Review. Future Internet 2020, 12, 103. [Google Scholar] [CrossRef]
- Förstl, N.; Adler, I.; Süß, F.; Dendorfer, S. Technologies for Evaluation of Pelvic Floor Functionality: A Systematic Review. Sensors 2024, 24, 4001. [Google Scholar] [CrossRef] [PubMed]
- Ahmad, L.; Khanji, S.; Iqbal, F.; Kamoun, F. Blockchain-based chain of custody: Towards real-time tamper-proof evidence management. In Proceedings of the 15th International Conference on Availability, Reliability and Security, Virtual Event, Ireland, 25–28 August 2020; pp. 1–8. [Google Scholar]
- Siaam, I.B.S.; Mahmud, N.; Titas, A.R. Securing Digital Evidence with Blockchain; Islamic University of Technology: Gazipur, Bangladesh, 2022. [Google Scholar]
- Billard, D. Weighted Forensics Evidence Using Blockchain. In Proceedings of the 2018 International Conference on Computing and Data Engineering, Shanghai, China, 4–6 May 2018; pp. 57–61. [Google Scholar] [CrossRef]
- Chopade, M.; Khan, S.; Shaikh, U.; Pawar, R. Digital Forensics: Maintaining Chain of Custody Using Blockchain. In Proceedings of the 2019 Third International conference on I-SMAC (IoT in Social, Mobile, Analytics and Cloud) (I-SMAC), Palladam, India, 12–14 December 2019; pp. 744–747. [Google Scholar]
- Florid, M.I.; Mutaqin, H.; Purnamasari, P. Analyze the Application of Blockchain Technology in Digital Forensics and Hunt for Threats Lurking in Security. Asian J. Manag. Entrep. Soc. Sci. 2024, 4, 1407-1017. [Google Scholar]
- Fröwis, M.; Gottschalk, T.; Haslhofer, B.; Rückert, C.; Pesch, P. Safeguarding the evidential value of forensic cryptocurrency investigations. Forensic Sci. Int. Digit. Investig. 2020, 33, 200902. [Google Scholar] [CrossRef]
- Hsu, C.-L.; Chen, W.-X.; Le, T.-V. An Autonomous Log Storage Management Protocol with Blockchain Mechanism and Access Control for the Internet of Things. Sensors 2020, 20, 6471. [Google Scholar] [CrossRef] [PubMed]
- Jin, P.; Kim, N.; Lee, S.; Jeong, D. Forensic investigation of the dark web on the Tor network: Pathway toward the surface web. Int. J. Inf. Secur. 2024, 23, 331–346. [Google Scholar] [CrossRef]
- Khan, A.A.; Uddin, M.; Shaikh, A.A.; Laghari, A.A.; Rajput, A.E. MF-Ledger: Blockchain Hyperledger Sawtooth-Enabled Novel and Secure Multimedia Chain of Custody Forensic Investigation Architecture. IEEE Access 2021, 9, 103637–103650. [Google Scholar] [CrossRef]
- Khanji, S.; Alfandi, O.; Ahmad, L.; Kakkengal, L.; Al-kfairy, M. A systematic analysis on the readiness of Blockchain integration in IoT forensics. Forensic Sci. Int. Digit. Investig. 2022, 42, 301472. [Google Scholar] [CrossRef]
- Li, M.; Lal, C.; Conti, M.; Hu, D. LEChain: A blockchain-based lawful evidence management scheme for digital forensics. Future Gener. Comput. Syst. 2021, 115, 406–420. [Google Scholar] [CrossRef]
- Mahrous, W.A.; Farouk, M.; Darwish, S.M. An Enhanced Blockchain-Based IoT Digital Forensics Architecture Using Fuzzy Hash. IEEE Access 2021, 9, 151327–151336. [Google Scholar] [CrossRef]
- Muyambo, E.; Baror, S. Systematic Review to Propose a Blockchain-based Digital Forensic Ready Internet Voting System. Int. Conf. Cyber Warf. Secur. 2024, 19, 219–230. [Google Scholar] [CrossRef]
- Patil, H.; Kohli, R.K.; Puri, S.; Puri, P. Potential applicability of blockchain technology in the maintenance of chain of custody in forensic casework. Egypt. J. Forensic Sci. 2024, 14, 12. [Google Scholar] [CrossRef]
- Ryu, J.H.; Sharma, P.K.; Jo, J.H.; Park, J.H. A blockchain-based decentralized efficient investigation framework for IoT digital forensics. J. Supercomput. 2019, 75, 4372–4387. [Google Scholar] [CrossRef]
- Sheelvant, Y. An Implementation of Blockchain Technology in Forensic Evidence Management system. Int. Res. J. Mod. Eng. Technol. Sci. (IRJMETS) 2023, 5, 194–198. [Google Scholar]
- Zarpala, L.; Casino, F. A blockchain-based Forensic Model for Financial Crime Investigation: The Embezzlement Scenario. Digit. Finance 2021, 3, 301–332. [Google Scholar] [CrossRef]
- Sakshi; Malik, A.; Sharma, A.K. A survey on blockchain based IoT forensic evidence preservation: Research trends and current challenges. Multimed. Tools Appl. 2023, 83, 42413–42458. [Google Scholar] [CrossRef]
- Alqahtany, S.S.; Syed, T.A. ForensicTransMonitor: A Comprehensive Blockchain Approach to Reinvent Digital Forensics and Evidence Management. Information 2024, 15, 109. [Google Scholar] [CrossRef]
- Onyeashie, B.I.; Leimich, P.; McKeown, S.; Russell, G. A Bibliometric Analysis and Systematic Review of a Blockchain-Based Chain of Custody for Digital Evidence. In Big Data Technologies and Applications; Tan, Z., Wu, Y., Xu, M., Eds.; Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering; Springer Nature: Cham, Switzerland, 2024; Volume 555, pp. 112–131. ISBN 978-3-031-52264-2. [Google Scholar]
- Goyal, R. Blockchain Technology in Forensic Science. A Bibliometric Review. In Proceedings of the 2021 3rd International Conference on Advances in Computing, Communication Control and Networking (ICAC3N), Greater Noida, India, 17–18 December 2021. [Google Scholar]
- Jacob, J.; Kumar, S. A Framework for Digital Forensics Using Blockchain to Secure Digital Data. In Proceedings of the 2022 IEEE World Conference on Applied Intelligence and Computing (AIC), Sonbhadra, India, 17–19 June 2022; pp. 899–904. [Google Scholar]
- Akbarfam, A.J.; Heidaripour, M.; Maleki, H.; Dorai, G.; Agrawal, G. ForensiBlock: A Provenance-Driven Blockchain Framework for Data Forensics and Auditability. arXiv 2023, arXiv:2308.03927. [Google Scholar]
- Mas’ud, M.Z.; Hassan, A.; Shah, W.M.; Abdul-Latip, S.F.; Ahmad, R.; Ariffin, A.; Yunos, Z. A Review of Digital Forensics Framework for Blockchain in Cryptocurrency Technology. In Proceedings of the 2021 3rd International Cyber Resilience Conference (CRC), Langkawi Island, Malaysia, 29–31 January 2021; pp. 1–6. [Google Scholar]
- Almutairi, W.; Moulahi, T. Joining Federated Learning to Blockchain for Digital Forensics in IoT. Computers 2023, 12, 157. [Google Scholar] [CrossRef]
- Cong, L.; Grauer, K.; Rabetti, D.; Updegrave, H. Blockchain Forensics and Crypto-Related Cybercrimes. SSRN J. 2023, 1–115. [Google Scholar] [CrossRef]
- Alqahtany, S.S.; Syed, T.A. Integrating Blockchain and Deep Learning for Enhanced Mobile VPN Forensics: A Comprehensive Framework. Appl. Sci. 2024, 14, 4421. [Google Scholar] [CrossRef]
- Srivasthav, D.P.; Maddali, L.P.; Vigneswaran, R. Study of Blockchain Forensics and Analytics tools. In Proceedings of the 2021 3rd Conference on Blockchain Research & Applications for Innovative Networks and Services (BRAINS), Paris, France, 27–30 September 2021; pp. 39–40. [Google Scholar]
- Khan, A.A.; Shaikh, A.A.; Laghari, A.A. IoT with Multimedia Investigation: A Secure Process of Digital Forensics Chain-of-Custody using Blockchain Hyperledger Sawtooth. Arab. J. Sci. Eng. 2023, 48, 10173–10188. [Google Scholar] [CrossRef]
- Al-Khateeb, H.; Epiphaniou, G.; Daly, H. Blockchain for Modern Digital Forensics: The Chain-of-Custody as a Distributed Ledger. In Blockchain and Clinical Trial; Jahankhani, H., Kendzierskyj, S., Jamal, A., Epiphaniou, G., Al-Khateeb, H., Eds.; Advanced Sciences and Technologies for Security Applications; Springer International Publishing: Cham, Switzerland, 2019; pp. 149–168. ISBN 978-3-030-11288-2. [Google Scholar]
- Ragu, G.; Ramamoorthy, S. A blockchain-based cloud forensics architecture for privacy leakage prediction with cloud. Healthc. Anal. 2023, 4, 100220. [Google Scholar] [CrossRef]
- Brotsis, S.; Grammatikakis, K.P.; Kavallieros, D.; Mazilu, A.I.; Kolokotronis, N.; Limniotis, K.; Vassilakis, C. Blockchain meets Internet of Things (IoT) forensics: A unified framework for IoT ecosystems. Internet Things 2023, 24, 100968. [Google Scholar] [CrossRef]
- Bonomi, S.; Casini, M.; Ciccotelli, C. B-CoC: A Blockchain-Based Chain of Custody for Evidences Management in Digital Forensics. Open Access Ser. Inform. (OASIcs) 2020, 71, 12:1–12:15. [Google Scholar] [CrossRef]
- Tian, Z.; Li, M.; Qiu, M.; Sun, Y.; Su, S. Block-DEF: A secure digital evidence framework using blockchain. Inf. Sci. 2019, 491, 151–165. [Google Scholar] [CrossRef]
- Lusetti, M.; Salsi, L.; Dallatana, A. A blockchain based solution for the custody of digital files in forensic medicine. Forensic Sci. Int. Digit. Investig. 2020, 35, 301017. [Google Scholar] [CrossRef]
- Verma, A.; Bhattacharya, P.; Saraswat, D.; Tanwar, S. NyaYa: Blockchain-based electronic law record management scheme for judicial investigations. J. Inf. Secur. Appl. 2021, 63, 103025. [Google Scholar] [CrossRef]
- Chen, S.; Zhao, C.; Huang, L.; Yuan, J.; Liu, M. Study and implementation on the application of blockchain in electronic evidence generation. Forensic Sci. Int. Digit. Investig. 2020, 35, 301001. [Google Scholar] [CrossRef]
- Awuson-David, K.; Al-Hadhrami, T.; Alazab, M.; Shah, N.; Shalaginov, A. BCFL logging: An approach to acquire and preserve admissible digital forensics evidence in cloud ecosystem. Future Gener. Comput. Syst. 2021, 122, 1–13. [Google Scholar] [CrossRef]
- Olukoya, O. Distilling blockchain requirements for digital investigation platforms. J. Inf. Secur. Appl. 2021, 62, 102969. [Google Scholar] [CrossRef]
- Burri, X.; Casey, E.; Bollé, T.; Jaquet-Chiffelle, D.-O. Chronological independently verifiable electronic chain of custody ledger using blockchain technology. Forensic Sci. Int. Digit. Investig. 2020, 33, 300976. [Google Scholar] [CrossRef]
- Naqvi, S. Challenges of Cryptocurrencies Forensics: A Case Study of Investigating, Evidencing and Prosecuting Organised Cybercriminals. In Proceedings of the 13th International Conference on Availability, Reliability and Security, Association for Computing Machinery, New York, NY, USA, 27–30 August 2018; pp. 1–5. [Google Scholar]
- Rana, S.K.; Rana, A.K.; Rana, S.K.; Sharma, V.; Lilhore, U.K.; Khalaf, O.I.; Galletta, A. Decentralized Model to Protect Digital Evidence via Smart Contracts Using Layer 2 Polygon Blockchain. IEEE Access 2023, 11, 83289–83300. [Google Scholar] [CrossRef]
- Agarwal, U.; Rishiwal, V.; Tanwar, S.; Yadav, M. Blockchain and crypto forensics: Investigating crypto frauds. Int. J. Netw. Manag. 2024, 34, e2255. [Google Scholar] [CrossRef]
- Ellul, J.; Galea, J.; Ganado, M.; Mccarthy, S.; Pace, G.J. Regulating Blockchain, DLT and Smart Contracts: A technology regulator’s perspective. ERA Forum 2020, 21, 209–220. [Google Scholar] [CrossRef]
- Batista, D.; Mangeth, A.L.; Frajhof, I.; Alves, P.H.; Nasser, R.; Robichez, G.; Silva, G.M.; Miranda, F.P. de Exploring Blockchain Technology for Chain of Custody Control in Physical Evidence: A Systematic Literature Review. J. Risk Financ. Manag. 2023, 16, 360. [Google Scholar] [CrossRef]
- Rožman, N.; Corn, M.; Škulj, G.; Berlec, T.; Diaci, J.; Podržaj, P. Exploring the Effects of Blockchain Scalability Limitations on Performance and User Behavior in Blockchain-Based Shared Manufacturing Systems: An Experimental Approach. Appl. Sci. 2023, 13, 4251. [Google Scholar] [CrossRef]
- Zbrog, M. Digital Forensics in Blockchain: How Investigators Track Crypto. Forensics Colleges. Available online: https://www.forensicscolleges.com/blog/blockchain-forensics (accessed on 20 July 2024).
- Atlam, H.F.; Azad, M.A.; Altamimi, M.; Fadhel, N. Role of Blockchain and AI in Security and Privacy of 6G. In AI and Blockchain Technology in 6G Wireless Network; Dutta Borah, M., Singh, P., Deka, G.C., Eds.; Springer Nature: Singapore, 2022; pp. 93–115. ISBN 978-981-19286-8-0. [Google Scholar]
- Mani, N.; Parab, S.S.; Manaswini, S.; Philip, S.; Hari, P.B.; Singh, N. Forensic Block Chain and it’s linkage with Artificial Intelligence: A new Approach. In Proceedings of the 2021 2nd International Conference on Computation, Automation and Knowledge Management (ICCAKM), Dubai, United Arab Emirates, 19–21 January 2021; pp. 70–74. [Google Scholar]
- BIG Investigations. The New Era Must-Have Blockchain Investigator Training. Blockchain Intelligence Group. 2024. Available online: https://blockchaingroup.io/the-new-era-must-have-blockchain-investigator-training/ (accessed on 20 July 2024).
Data Source | Phase 1 | Phase 2 | Phase 3 |
---|---|---|---|
Google Scholar | 421 | 27 | 18 |
IEEE explore | 153 | 12 | 8 |
PubMed | 6 | 2 | 1 |
Elsevier ScienceDirect | 27 | 13 | 9 |
ACM Digital Library | 31 | 9 | 5 |
SpringerLink | 34 | 8 | 5 |
Total | 672 | 71 | 46 |
Citation | Summary of Contribution | Limitations |
---|---|---|
Ahmad et al. [28] | This paper proposes a blockchain-based chain of custody framework to ensure tamper-proof evidence management. The framework uses a private Ethereum blockchain to securely record evidence metadata while storing physical evidence in a reliable medium locked with smart locks. This approach aims to provide authenticated access, maintaining evidence integrity and admissibility among multiple stakeholders. | The scalability issues inherent in private blockchains and the need for smooth integration with existing digital evidence systems. Also, it does not discuss or address the challenges of managing large volumes of evidence and their associated costs. |
Akinbi et al. [24] | This paper presents a comprehensive review of blockchain-based IoT forensic investigation models. It systematically reviews how blockchain is used to securely improve forensic investigations and discusses the efficiency of these models. This paper highlights the challenges, open issues, and future research directions of blockchain in IoT forensic investigations. | This paper does not provide a detailed analysis of the different techniques and methodologies used, and it does not discuss the legal and ethical implications of using blockchain in IoT forensic investigations. |
Siaam et al. [29] | This paper proposes Probe-IoT, a forensic investigation framework for IoT systems that uses a public digital ledger to identify facts in IoT crime cases. It addresses the challenges of evidence spoliation and lack of transparency in IoT environments by recording interactions between IoT devices, users, and cloud services on a blockchain. The framework allows investigators to trace the flow of data and identify potential perpetrators. | This paper lacks a detailed implementation and evaluation of the proposed framework. In addition, the dependence on a public blockchain could raise privacy and legal concerns for users, as their interactions and communications are publicly accessible. |
Billard [30] | This paper proposes a framework for building a fact-based confidence rating of digital evidence. It uses a blockchain-based Digital Evidence Inventory (DEI) to ensure immutability and traceability, categorizes digital evidence into data types with associated confidence ratings, and creates a Global Digital Timeline (GDT) to order evidence through time. | The confidence rating system needs to be refined by incorporating error rate probabilities and relevance measures. This paper also relies on expert’s judgment for data categorization and rating, which adds subjectivity to the process. |
Cebe et al. [1] | This paper proposes a blockchain-based framework called Block4Forensic (B4F) for vehicular forensics. B4F provides a secure, trustworthy, and comprehensive platform for collecting and analysing vehicle data. It integrates vehicular public key infrastructure for membership establishment and privacy and utilizes a fragmented ledger to store detailed vehicle information. B4F enables trustless, traceable, and privacy-aware post-accident analysis, facilitating dispute resolution and identifying faulty parties. | This paper lacks implementation details and performance evaluation. This paper also does not address the practical challenges of integrating B4F with existing vehicular systems. Also, this paper does not discuss potential security vulnerabilities of the proposed framework. |
Chopade et al. [31] | This paper proposes a blockchain-based model for maintaining the chain of custody in digital forensics. The model utilizes a distributed ledger to record and track the transfer of digital evidence between various participants in an investigation to ensure its integrity and authenticity. The model employs Base64 encryption to generate a hash of the evidence, which is then transferred instead of the original data, preventing tampering and providing a verifiable record of ownership. | This paper lacks implementation and evaluation of the proposed model. It also does not discuss integrating the model with existing digital forensic frameworks and does not consider potential security vulnerabilities of using Base64 for evidence hashing, which could be vulnerable to certain attacks. |
Dasaklis et al. [8] | This paper provides a comprehensive overview and classification of blockchain-based digital forensic tools to analyse their main features, benefits, and challenges. It examines the potential of blockchain to enhance digital forensics by addressing issues including evidence immutability, transparency, and auditability. | This paper does not discuss the legal, regulatory, and ethical implications of using blockchain in digital forensic investigations, which are crucial considerations for real-world applications. |
Floride et al. [32] | This paper explores the application of blockchain in digital forensics, particularly focusing on its use in threat hunting and evidence management. It highlights the benefits of blockchain in ensuring evidence integrity, traceability, and immutability. This paper also examines the use of deep learning models for detecting vulnerabilities in smart contracts on the Ethereum blockchain. | This paper does not consider the practical challenges of implementing blockchain-based digital forensic systems in real-world applications. This paper also lacks empirical research to validate the effectiveness of the framework. |
Frowis et al. [33] | This paper investigates the legal and technical aspects of forensic cryptocurrency investigations. It identifies key legal requirements for safeguarding the evidential value of such investigations, including lawfulness, authenticity, reliability, qualification, verifiability, chain of evidence, and the right to inspect records. This paper then translates these requirements into a data-sharing framework for law enforcement agencies to promote efficient and effective investigations while protecting individuals’ privacy. | This paper lacks an in-depth analysis of blockchain forensic tools and techniques and does not provide a complete evaluation of the effectiveness of the proposed technique. This paper also does not discuss the complex legal implications of processing publicly available data for law enforcement purposes. |
Hsu et al. [34] | This paper proposes an autonomous log storage management protocol for IoT environments that incorporates blockchain mechanisms and access control. Integrating blockchain and a novel “signature chain” concept provides robust identity verification, data integrity, non-repudiation, tamper resistance, and evidence legality, making it suitable for digital forensic investigations. | The performance of the proposed protocol in large-scale IoT deployments with high data volumes needs to be discussed. This paper does not discuss potential scalability issues associated with blockchain, particularly in terms of transaction throughput and latency. |
Jin et al. [35] | This paper proposes a methodology for tracing operators of illegal dark websites through cryptocurrency transactions. It highlights the importance of tracking the flow of funds on the blockchain to link Bitcoin addresses to real-world bank accounts and use it in digital forensic investigations. This paper provides valuable insights into identifying perpetrators by analysing cryptocurrency transactions, despite the anonymity provided by cryptocurrencies. | This paper focuses only on publicly available information, neglecting the complexities of cryptocurrency and dynamic Bitcoin addresses. Also, this paper relies on POW consensus, which introduces latency and energy inefficiency, impacting real-time forensic analysis. |
Khan et al. [36] | This paper proposes MF-Ledger, a blockchain-based architecture for multimedia digital forensic investigations using Hyperledger Sawtooth. MF-Ledger provides secure evidence integrity, preservation, transparency, and resistance to tampering by leveraging a permissioned blockchain network. It addresses the challenges of traditional digital forensics by offering a secure and transparent process for collecting, storing, analysing, and interpreting digital evidence. The architecture utilizes smart contracts to manage the chain of custody events and ensures privacy protection for evidence stored in an encrypted ledger. | This paper does not consider the challenges of implementing the proposed method in the real world. The proposed architecture is only simulated using sequence diagrams; however, it lacks validation and evaluation in a real-world forensic environment. Furthermore, this paper does not address the legal and regulatory challenges associated with using blockchain in forensic investigations. |
Khanji et al. [37] | This paper presents a systematic review of the readiness of blockchain integration in IoT forensics. It analyses the literature to review the deployment of Blockchain to resolve various challenges presented in IoT forensics. | This paper does not provide a detailed analysis of the efficiency of the different models and frameworks reviewed in the literature. |
Li et al. [38] | This paper proposes LEChain, a blockchain-based lawful evidence management scheme for digital forensics that addresses the entire lifecycle of evidence, from collection to court trial and sentencing. LEChain utilizes short randomizable signatures for anonymous witness authentication, fine-grained access control based on CP-ABE for evidence access, and secure voting to protect juror privacy. The system is built on a consortium blockchain to ensure transparency, immutability, and auditability of evidence transactions. | The proposed method was implemented on a consortium blockchain, which may not be suitable for all digital forensic scenarios. In addition, the evaluation of the proposed technique is based on a local Ethereum test network, which may not accurately reflect the performance of the system in a real-world setting. |
Li et al. [7] | This paper proposes a blockchain-based digital forensic framework for the IoT, called IoT Forensic-Chain (IoTFC). IoTFC records all examination operations, including evidence identification, preservation, analysis, and presentation, in a chain of blocks. | This paper does not discuss potential privacy concerns associated with storing sensitive evidence on a public blockchain. |
Mahrous et al. [39] | This paper proposes a blockchain-based IoT digital forensic architecture that incorporates fuzzy hashing into the blockchain’s Merkle tree. This approach enhances the ability to identify potentially incriminating evidence that may have undergone benign or malicious alterations, which traditional hashing methods struggle to detect. By comparing blocks/files to all nodes in the blockchain network using fuzzy hash similarity, digital forensic investigators can verify their authenticity. | This paper does not discuss the challenges of integrating fuzzy hashing into existing blockchain platforms or discuss the potential performance overhead associated with fuzzy hash computations. Also, this paper lacks a detailed analysis of the security implications of using fuzzy hashing in a blockchain context. |
Muyambo et al. [40] | This paper presents a systematic review of blockchain-based digital forensics in Internet voting systems. This paper also proposes a blockchain-based digital forensic-ready internet voting system called DFRMIV, which addresses issues of transparency, privacy, integrity, confidentiality, and auditability in online voting systems. | This paper does not discuss detailed information and technical details on how the proposed DFRMIV system would work in practice and how it would address challenges related to blockchain forensics. |
Patil et al. [41] | This paper explores the potential of blockchain to improve the chain of custody in forensic investigations. It highlights how blockchain’s decentralized, immutable, and transparent nature can address challenges like evidence tampering, excessive paperwork, and difficulty in tracking evidence interactions. The authors also propose a framework where evidence details are recorded on a blockchain, creating a tamper-proof and auditable record. | This paper lacks real implementation details and analysis of the practical challenges of blockchain in the chain of custody. This paper also lacks a detailed discussion on the legal and ethical implications of using blockchain in forensic investigations. |
Ryu et al. [42] | This paper proposes a blockchain-based framework for digital forensics in the IoT. The framework utilizes blockchain to store all communications of IoT devices as transactions to ensure data integrity and simplify the chain of custody process. This decentralized approach enhances security, transparency, and reliability. | This paper does not discuss the technical details of implementing the proposed framework, such as the specific blockchain platform used or the methods for verifying digital signatures. |
Sheelvanth et al. [43] | This paper proposes a blockchain-based forensic evidence management system to address vulnerabilities in traditional systems. It utilizes blockchain’s decentralized and immutable nature to ensure data integrity, automate the chain of custody, and enhance transparency and accountability. | This paper only focuses on the conceptual design and lacks a detailed technical implementation, such as the specific blockchain platform used or the cryptographic algorithms employed. |
Xiao et al. [6] | This paper proposes a blockchain-based digital forensic framework for IIoT environments. It utilizes a decentralized blockchain storage mechanism to ensure tamper-proof and permanent storage of digital evidence. The framework utilizes smart contracts for efficient evidence retrieval and tracing, and a token mechanism for access control. | This paper does not discuss the potential privacy risks associated with storing sensitive IIoT data on a public blockchain. Also, this paper does not explore the scalability of the proposed framework for handling large volumes of data generated by IIoT systems. |
Zarpala and Casino [44] | This paper proposes a blockchain-based forensic model for financial crime investigations. The model uses blockchain’s immutability and verifiability to create a tamper-proof audit trail to ensure the integrity of evidence and facilitate the chain of custody. | This paper focuses only on the embezzlement scenario, which limits its generalizability to other financial crimes. |
Sakshi et al. [45] | This paper provides a review of research trends and challenges related to blockchain-based IoT forensic evidence preservation. It analyses the integration of blockchain with IoT forensics and discusses various blockchain platforms and tools. | This paper lacks technical details on implementing blockchain solutions for evidence preservation. It also does not discuss legal and regulatory aspects. |
Alqahtany and Syed [46] | This paper proposes a framework for integrating blockchain technology into digital forensics, encompassing data preservation, acquisition, analysis, and documentation. The framework utilizes smart contracts and APIs to record every forensic transaction on the blockchain to ensure transparency, immutability, and authenticity of the evidence. | This paper focuses only on the conceptual design and theoretical aspects of the framework. It lacks detailed implementation and evaluation of the proposed solution on a real-world blockchain platform. |
Onyeashie et al. [47] | This paper provides a systematic review of blockchain applications in the chain of custody. It examines how blockchain can strengthen the evidential chain of custody and interoperate with actual evidence storage. This paper highlights the benefits of blockchain in providing an immutable and decentralized structure for documenting and auditing evidence trails. | This paper does not discuss the implementation details of the system and real-world applications. This paper also does not discuss the technical challenges of integrating blockchain with existing forensic tools. |
Kumar et al. [19] | This paper proposes a blockchain-based digital forensics framework called Internet-of-Forensics (IoF) for the IoT. IoF addresses the lack of transparency and heterogeneity in IoT using a consortium blockchain to manage evidence and ensure the chain of custody. It uses lattice-based cryptography for low complexity and post-quantum security, making it suitable for resource-constrained devices. | This paper does not discuss the practical challenges of integrating the proposed framework with existing forensic tools. Also, this paper does not evaluate the performance of the proposed framework in real-world scenarios. |
Goyal [48] | This paper provides a review of blockchain in forensic science by highlighting the potential of blockchain to enhance privacy, authenticity, reliability, and evidence management in forensic investigations. | This paper does not discuss technical details, novel forensic frameworks, or considerations and evaluation related to real-world implementation. |
Jacob and Kumar [49] | This paper proposes a framework for digital forensics using blockchain to secure digital data. The framework uses blockchain’s immutability and transparency to ensure the integrity and authenticity of digital evidence. | The proposed framework is only conceptual and does not address practical challenges such as scalability, interoperability, and legal considerations. |
Akbarfam et al. [50] | This paper presents ForensiBlock, a private blockchain framework designed for digital forensics provenance. ForensiBlock ensures secure data access, traces data origins, preserves records, and expedites provenance extraction, offering a secure, efficient, and reliable solution for handling digital forensic data. | This paper does not provide a detailed analysis of the performance of ForensiBlock in real-world scenarios. It also does not discuss the scalability of the proposed framework. |
Masud et al. [51] | This paper reviews existing research on digital forensics frameworks for blockchain and cryptocurrency. It highlights the challenges and opportunities in applying digital forensic techniques to the unique characteristics of blockchain. | This paper does not discuss methods for evidence preservation in blockchain, which is a critical aspect for ensuring the admissibility of digital evidence. |
Almutairi and Moulahi [52] | This paper proposes a framework for digital forensics in IoT that combines blockchain and federated learning. The blockchain is used to store the trained models from the federated learning process to ensure data integrity and traceability. The federated learning is used to address privacy concerns associated with data sharing. | This paper does not discuss the potential for blockchain attacks, such as 51% attacks, which could compromise the integrity of the evidence stored on the blockchain. |
Cong et al. [53] | This paper explores various criminal activities related to cryptocurrencies, including investment scams, Ponzi schemes, rug pulls, ransomware attacks, money laundering, and darknet markets. It discusses how blockchain forensic techniques can be used to investigate and limit some of these cybercrimes. | This paper lacks a detailed technical analysis and implementation of blockchain forensic techniques and methods and their application in real-world investigations. |
Alqahtany and Syed [54] | This paper proposes a framework for mobile VPN forensics by integrating blockchain with deep learning models. The blockchain acts as a secure and tamper-proof ledger for recording VPN transactions to enhance the integrity and admissibility of forensic evidence. | This paper does not discuss potential challenges related to blockchain scalability, transaction costs, or privacy concerns associated with storing sensitive VPN data on a public blockchain. |
Srivasthav et al. [55] | This paper provides a survey of blockchain forensics and analytics tools, categorizing them based on their key features and comparing them across three practical parameters: cryptocurrency support, feature availability, and ease of access. | This paper focuses on only a limited number of tools and does not consider the rapidly evolving landscape of blockchain forensics. |
Khan et al. [56] | This paper proposes an IoT-blockchain architecture for multimedia forensics investigations. The proposed system utilizes a private permissioned network to facilitate secure collaboration among stakeholders, including the exchange of video surveillance data and chain-of-custody details. Smart contracts automate ledger verification and validation, ensuring immutability and transparency in the investigation process. | This paper lacks a detailed analysis of the performance impact of smart contracts on the blockchain network. In addition, this paper does not discuss the scalability challenges of the proposed system when handling a large volume of multimedia data. |
Al-Khateeb et al. [57] | This paper surveys the potential of blockchain to enhance digital forensics and incident response. It argues that blockchain can improve the implementation of digital investigation models by automating the identification and preservation phases. | This paper lacks technical details and implementation strategies for integrating blockchain into existing digital investigation frameworks. |
Ragu and S. [58] | This paper proposes a blockchain-based cloud forensics architecture for privacy leakage prediction using SDN and blockchain to address the challenges of evidence integrity and centralized evidence collection in cloud environments. | This paper focuses only on the conceptual design and lacks technical details and evaluation of the proposed system in a real-world scenario. |
Brotsis et al. [59] | This paper reviews recent blockchain-enabled forensics frameworks and extracts best practices for integrating blockchain into the process. It then presents a novel blockchain-enabled platform for IoT forensics, implemented with Hyperledger Fabric and evaluated on a virtualized testbed. | This paper focuses only on a specific blockchain platform (Hyperledger Fabric) and a limited number of attack scenarios. It also does not discuss the privacy implications of the proposed system. |
Bonomi et al. [60] | This paper proposes a blockchain-based chain of custody (B-CoC) for managing digital evidence in digital forensics. B-CoC utilizes a private permissioned blockchain to ensure the integrity, traceability, authentication, and verifiability of digital evidence throughout its lifecycle. | This paper does not discuss the legal and practical implications of the proposed system. This paper also does not discuss the potential challenges of integrating B-CoC with existing legal frameworks. |
Tian et al. [61] | This paper proposes a secure digital evidence framework using blockchain (Block-DEF) for blockchain forensics. Block-DEF employs a mixed block structure and a name-based consensus mechanism to address blockchain scalability issues. | This paper does not discuss the security implications of the Block-DEF and does not discuss the challenges of integrating Block-DEF with existing frameworks. |
Lusetti et al. [62] | This paper proposes a blockchain-based solution called Custody Chain (CC) for the secure storage and sharing of digital forensic medical evidence. CC uses a hybrid platform that encrypts digital evidence and stores it in a redundant online file storage system, while using a private Hyperledger Fabric blockchain to record file properties, access history, and user permissions. | The proposed solution is mainly based on a private and permissioned blockchain, which limits the potential for wider adoption and interoperability with other forensic systems. |
Verma et al. [63] | This paper proposes a blockchain-based electronic law record management scheme called NyaYa, which utilizes a public blockchain with off-chain storage in IPFS to maintain ELRs to ensure scalability and security. It also incorporates smart contracts for case closure and financial settlements. | This paper does not provide a detailed analysis of the security of the proposed scheme against existing blockchain forensic attacks. |
Chen et al. [64] | This paper reviews the application of blockchain in generating electronic evidence for judicial proceedings, specifically focusing on its benefits in ensuring immutability, traceability, and independence of evidence. This paper proposes a consortium blockchain-based system for electronic evidence generation, enabling judicial bodies to verify evidence legitimacy and improve the reliability of evidence. | This paper lacks a discussion of specific forensic techniques and tools used for evidence analysis on the blockchain. This paper focuses on a single case study, which limits its generalizability to other types of cases and blockchain platforms. |
Awuson-David et al. [65] | This paper proposes a Blockchain Cloud Forensic Logging (BCFL) framework that uses a permissioned blockchain to maintain tamper-proof logs within the cloud ecosystem. BCFL integrates a permissioned blockchain into the cloud, enabling evidence acquisition that enhances GDPR compliance and maintains a secured chain of custody. | This paper focuses only on a single case study, which may not be generalizable to other cloud environments. This paper also does not discuss potential scalability issues of the BCFL framework. |
Olukoya et al. [66] | This paper proposes a framework for distilling blockchain requirements for security incident response platforms (SIRPs) to enhance auditability and integrity. The framework extracts actions, audit records, and relevant metadata from the SIRP, then designs payloads for these actions and defines a blockchain structure for storing the transactions. | This paper lacks a comprehensive evaluation of the proposed framework’s performance and scalability. This paper also does not address the potential challenges of integrating the proposed blockchain system with existing SIRPs. |
Burri et al. [67] | This paper proposes a blockchain-based solution for maintaining a chronological and independently verifiable electronic chain of custody (e-CoC) ledger for digital evidence using a private blockchain managed by a trusted entity, with periodic updates to a public blockchain for enhanced security. | The proposed solution relies on the integrity of the trusted entity and does not fully address the decentralized nature of blockchain technology. |
Citation | Evidence Integrity | Chain of Custody | Transparency | Auditability | Security | Scalability |
---|---|---|---|---|---|---|
Ahmad et al. [28] | ✓ | × | × | × | ✓ | × |
Siaam et al. [29] | × | × | ✓ | × | × | × |
Billard [30] | × | ✓ | × | × | × | × |
Cebe et al. [1] | × | ✓ | ✓ | ✓ | × | × |
Chopade et al. [31] | ✓ | × | × | ✓ | × | × |
Hsu et al. [34] | × | × | × | × | ✓ | × |
Khan et al. [36] | × | ✓ | ✓ | × | × | × |
Li et al. [38] | ✓ | × | ✓ | ✓ | × | × |
Li et al. [7] | × | ✓ | ✓ | × | × | × |
Mahrous et al. [39] | ✓ | × | × | × | × | × |
Muyambo et al. [40] | × | ✓ | ✓ | × | × | × |
Ryu et al. [42] | × | × | × | ✓ | × | × |
Sheelvanth et al. [43] | × | ✓ | × | × | × | × |
Xiao et al. [6] | × | ✓ | × | × | ✓ | × |
Zarpala and Casino [44] | ✓ | × | × | ✓ | × | × |
Alqahtany and Syed [46] | × | × | ✓ | ✓ | × | × |
Kumar et al. [19] | × | ✓ | ✓ | × | ✓ | × |
Jacob and Kumar [49] | ✓ | × | ✓ | × | × | × |
Akbarfam et al. [50] | ✓ | ✓ | × | × | × | × |
Almutairi and Moulahi [52] | × | ✓ | ✓ | × | × | ✓ |
Alqahtany and Syed [54] | ✓ | × | × | × | × | × |
Khan et al. [56] | ✓ | × | ✓ | ✓ | ✓ | × |
Ragu and S. [58] | ✓ | × | × | ✓ | × | × |
Bonomi et al. [60] | ✓ | ✓ | × | × | × | × |
Tian et al. [61] | × | × | ✓ | × | ✓ | ✓ |
Lusetti et al. [62] | × | × | × | ✓ | × | ✓ |
Verma et al. [63] | × | × | ✓ | × | ✓ | ✓ |
Chen at al. [64] | ✓ | ✓ | ✓ | × | × | × |
Awuson-David et al. [65] | ✓ | × | × | × | ✓ | × |
Olukoya et al. [66] | × | ✓ | ✓ | × | × | × |
Burri et al. [67] | ✓ | ✓ | ✓ | × | × | × |
Citation | Digital Forensic Frameworks and Methodologies |
---|---|
Ahmad et al. [28] | The proposed framework consists of three layers: an evidence layer with smart locks for secure evidence storage, a blockchain layer using a private Ethereum for tamper-proof metadata recording, and a network layer enabling communication among authorized parties. |
Siaam et al. [29] | The proposed IoT probe framework involves four key components: Transaction Creation, Insertion into Blockchain Ledgers, Escrow Service, and Investigation Analysis. |
Billard [30] | This paper proposes a digital forensic framework consisting of three key components: the DEI, the Forensics Confidence Rating (FCR), and the GDT for timeline reconstruction and presentation. |
Cebe et al. [1] | The proposed Block4Forensic (B4F) consists of a forensic daemon, a permissioned blockchain, and various stakeholders. B4F’s forensic daemon mirrors collection, the blockchain acts as secure storage, and stakeholder interactions represent analysis and reporting. |
Chopade et al. [31] | The proposed blockchain-based framework includes evidence creation, evidence hash transfer, and evidence display. This framework enhances the reliability and security of digital evidence throughout the investigation lifecycle. |
Hsu et al. [34] | The proposed blockchain-based framework for IoT includes components for the acquisition of sensor logs, analysis of log data, and presentation of evidence in a tamper-proof and legally defensible manner. The framework also utilizes a signature chain to ensure data integrity and non-repudiation. |
Khan et al. [36] | The proposed MF-Ledger framework consists of a private, permissioned network where stakeholders securely interact using smart contracts to record and manage evidence. This ensures transparency, immutability, and secure storage of the evidence chain of custody. |
Li et al. [38] | The proposed LEChain framework manages evidence from its collection by victims, witnesses, and monitoring devices, through analysis by crime scene analysts, to its upload and access via the blockchain, closing in a court trial. |
Li et al. [7] | The proposed IoTFC framework consists of users and IoT devices, Merkle tree, blocks, and smart contracts. The output of the framework includes a comprehensive view of evidence items, continuous integrity, immutability and audibility, tamper-proof environment, full provenance, and traceability. |
Mahrous et al. [39] | The proposed framework consists of evidence acquisition, a forensic-chain framework, and blockchain-based evidence management. It involves acquisition for uploading fingerprinted records to the blockchain, analysis to verify the authenticity of the evidence items, and reporting to generate a report for the investigation |
Muyambo et al. [40] | The proposed DFRMIV framework consists of four main layers: the acquisition layer to gather evidence from the blockchain network, the preservation layer to use cryptographic techniques and secure storage methods to preserve the integrity of the evidence, the analysis layer to analyse the preserved data to identify any anomalies or evidence of tampering, and the reporting layer to report the findings. |
Ryu et al. [42] | The proposed framework consists of three layers: the IoT device layer for gathering the evidence, the blockchain layer to utilize a block structure with a block header and transaction data, where each transaction includes a transaction ID, digital signature, and PUF IDs of the sender and receiver devices, and the participants’ layer where analysis and reporting of evidence occur. |
Sheelvanth et al. [43] | The proposed framework supports evidence acquisition through secure storage on the blockchain, analysis by providing access to authorized personnel and reporting through transparent and auditable records. |
Xiao et al. [6] | The proposed framework comprises a decentralized blockchain storage mechanism, smart contract mechanisms for evidence retrieval and tracing, a token mechanism for access control, and an efficient batch consensus algorithm. |
Zarpala and Casino [44] | The proposed framework consists of a smart contract deployed on the Ethereum blockchain that records all actions performed during the investigation. The framework also includes a mechanism for evidence custody changes and destruction, ensuring a complete and auditable trail of events. |
Alqahtany and Syed [46] | The proposed framework consists of data preservation, where a forensic image of the evidence is created; data acquisition, where the evidence is collected and analysed; and finally reporting, where the findings are documented. |
Kumar et al. [19] | The proposed IoF consists of four layers: Edge-IoF, Fog-IoF, Consortium-IoF, and Cloud Storage. Edge-IoF gathers evidence from heterogeneous devices, Fog-IoF performs forensic analysis and maintains the chain of custody, Consortium-IoF facilitates collaboration among various stakeholders, and Cloud Storage stores the evidence. |
Jacob and Kumar [49] | The proposed framework involves collecting digital evidence, hashing it, and storing it in the blockchain using a hash directory to prevent duplicate data. The evidence stored on the blockchain is then analysed, and the findings are documented. |
Akbarfam et al. [50] | The proposed ForensiBlock framework consists of three main components: blockchain, user nodes, and off-chain storage. The blockchain serves as a decentralized ledger for recording transactions and data changes. User nodes represent authorized individuals involved in investigations, while off-chain storage securely stores digital forensic data and maintains provenance records. |
Almutairi and Moulahi [52] | The proposed framework uses federated learning for privacy-preserving model training on IoT devices, followed by model aggregation on a lightweight blockchain. This process involves the acquisition of data from IoT devices, analysing them through federated learning, preservation of model parameters on the blockchain, and reporting results based on the aggregated models. |
Alqahtany and Syed [54] | The proposed framework consists of data collection, VPN traffic analysis using CNN and GNN models, and secure logging on a blockchain. The output of the framework is a comprehensive forensic report that includes the identification of the VPN protocol, the classification of VPN traffic, and the secure storage of the evidence on the blockchain. |
Khan et al. [56] | The proposed framework utilizes blockchain forensics tools to collect blockchain data, analyse transactions and addresses, and identify suspicious activities. The output is a report that includes identified high-risk activities, real-time analysis, and a strong audit trail. |
Ragu and S. [58] | The proposed framework consists of six stages: identification, preservation, collection, examination, analysis, and presentation. Blockchain is integrated into the framework to automate the acquisition and preservation phases, improving efficiency and reliability while providing continuous fraud detection and forensic readiness. |
Bonomi et al. [60] | The proposed B-CoC framework consists of seven phases: investigation initiation, incident reporting, preparation and planning, evidence identification, acquisition, preservation, analysis, presentation, and investigation closure. Blockchain is used to address issues related to evidence integrity, chain of custody, and data privacy. |
Tian et al. [61] | The proposed Block-DEF framework consists of three layers: a service layer for evidence submission and retrieval, a blockchain layer for consensus and storage of evidence information, and a network layer for communication. The evidence stored in the blockchain is then analysed, and the findings will be documented. |
Lusetti et al. [62] | The proposed CC framework combines a secure online file storage system with a private implementation of the Hyperledger FabricTM blockchain. The framework encompasses encryption, file hashing, and a robust chain-of-custody mechanism. The framework includes the acquisition of digital files, processing through encryption and hashing, analysis of file properties, and reporting of access logs and evidence in a secure and verifiable manner. |
Verma et al. [63] | The proposed NyaYa framework comprises four phases: registration of judicial stakeholders on the BC, case registration with meta-hash keys in the public BC to reference external off-chain interplanetary file storage, chronological updates of investigative findings among law enforcement agencies on the BC and IPFS, and case hearing and settlement through smart contracts. |
Chen et al. [64] | The proposed framework consists of data acquisition (screenshots and source code), data preservation (Factom blockchain), and data analysis (verification of SHA256 hash values, blockchain queries, and analysis of Bitcoin storage content). |
Awuson-David et al. [65] | The proposed BCFL framework consists of four key components: blockchain distributed ledger technology (DLT), smart contracts, data validation, and immutability. These components are used to acquire, preserve, analyse, and report digital evidence in the cloud ecosystem. |
Olukoya et al. [66] | The proposed framework utilizes Parnassus to record and manage forensic actions throughout the investigation lifecycle. This framework encompasses four key operations: acquisition of evidence using Parnassus to store evidence details, preservation of evidence integrity through blockchain immutability, analysis of evidence using tools integrated with Parnassus, and reporting of findings. |
Burri et al. [67] | The proposed e-CoC framework includes a secure ledger managed by a trusted entity, with blocks linked by hash values. The e-CoC ledger is periodically secured to a public blockchain for tamper-proof verification. Digital evidence is hashed, and the hash values are timestamped and stored in the e-CoC ledger. The evidence stored in the blockchain is then analysed, and the findings will be documented. |
Citation | IoT Forensics | Cloud Forensics | Vehicular Forensics | Mobile Forensics | Internet Voting | Dark Web | Multimedia Forensics |
---|---|---|---|---|---|---|---|
Akinbi et al. [24] | ✓ | × | × | × | × | × | × |
Siaam et al. [29] | ✓ | × | × | × | × | × | × |
Cebe et al. [1] | × | × | ✓ | × | × | × | × |
Hsu et al. [34] | ✓ | × | × | × | × | × | × |
Jin et al. [35] | × | × | × | × | × | ✓ | × |
Khan et al. [36] | × | × | × | × | × | × | ✓ |
Khanji et al. [37] | ✓ | × | × | × | × | × | × |
Li et al. [7] | ✓ | × | × | × | × | × | × |
Mahrous et al. [39] | ✓ | × | × | × | × | × | × |
Muyambo et al. [40] | × | × | × | × | ✓ | × | × |
Ryu et al. [42] | ✓ | × | × | × | × | × | × |
Xiao et al. [6] | ✓ | × | × | × | × | × | × |
Sakshi et al. [45] | ✓ | × | × | × | × | × | × |
Alqahtany and Syed [46] | × | ✓ | × | × | × | × | × |
Kumar et al. [19] | ✓ | × | × | × | × | × | × |
Almutairi and Moulahi [52] | ✓ | × | × | × | × | × | × |
Alqahtany and Syed [54] | × | × | × | ✓ | × | × | × |
Khan et al. [56] | ✓ | × | × | × | × | × | × |
Ragu and S. [58] | × | ✓ | × | × | × | × | × |
Brotsis et al. [59] | ✓ | × | × | × | × | × | × |
Awuson-David et al. [65] | × | ✓ | × | × | × | × | × |
Burri et al. [67] | × | ✓ | × | × | × | × | × |
Disclaimer/Publisher’s Note: The statements, opinions and data contained in all publications are solely those of the individual author(s) and contributor(s) and not of MDPI and/or the editor(s). MDPI and/or the editor(s) disclaim responsibility for any injury to people or property resulting from any ideas, methods, instructions or products referred to in the content. |
© 2024 by the authors. Licensee MDPI, Basel, Switzerland. This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution (CC BY) license (https://creativecommons.org/licenses/by/4.0/).
Share and Cite
Atlam, H.F.; Ekuri, N.; Azad, M.A.; Lallie, H.S. Blockchain Forensics: A Systematic Literature Review of Techniques, Applications, Challenges, and Future Directions. Electronics 2024, 13, 3568. https://doi.org/10.3390/electronics13173568
Atlam HF, Ekuri N, Azad MA, Lallie HS. Blockchain Forensics: A Systematic Literature Review of Techniques, Applications, Challenges, and Future Directions. Electronics. 2024; 13(17):3568. https://doi.org/10.3390/electronics13173568
Chicago/Turabian StyleAtlam, Hany F., Ndifon Ekuri, Muhammad Ajmal Azad, and Harjinder Singh Lallie. 2024. "Blockchain Forensics: A Systematic Literature Review of Techniques, Applications, Challenges, and Future Directions" Electronics 13, no. 17: 3568. https://doi.org/10.3390/electronics13173568