Toward Secure and Scalable Digital Evidence Preservation: A Blockchain-Driven Framework

Digital evidence management systems are designed to ensure that the digital evidence is genuine and effectively handle its complexity. In this work, blockchain technology is applied to handle the digital evidence by introducing several layers of security to ensure its protection, data integrity, and confidentiality, as well as trace the evidence throughout all its phases. To store the evidence files and their metadata, the proposed system uses a decentralized storage architecture that utilizes the InterPlanetary File System (IPFS) and Google Drive. Moreover, the proposed system ensures the chain of custody of the digital evidence through the use of Hyperledger Fabric technology. In addition, smart contracts (chaincode) are used in this work to validate the digital evidence, enforce strong access controls, and protect evidence metadata integrity. To ensure reliable transaction sequencing and consistency across the distributed ledger, an ordering service is used. At last, we combine two hash algorithms, symmetric encryption, file fragmentation, and metadata logging to protect the digital evidence from unauthorized access. The proposed framework is integrated with modern forensic tools, including Autopsy. The procedure of acquiring and analyzing digital evidence is made straightforward by the application of a set of forensic procedures. Moreover, the system’s modular design allows users to perform preprocessing operations, administer the decentralized storage, administer the evidence retrieval, test system performance, and enhance the system scalability. Moreover, we implemented secure coding practices and applied large language models to mitigate identified vulnerabilities, including weak system input validation, concurrent access to the system, and an insecure logging system. The experimental results indicate that the proposed framework preserves the digital evidence’s integrity, ensures chain of custody, and records all transactions. Results also indicate that the digital evidence is protected from unauthorized access and change attempts. Finally, by following local relevant regulations and established standards, the digital evidence should be admissible in court.