Procedure for Obtaining and Sharing the Digital Evidence

Abstract

The proposals presented in this paper have been realized to solve one of the main problems in the analysis of Digital Chain of Custody (CoC) in computer forensics, that is: the traceability of the procedure of evidence. Usually, the Evidence is obtained by scene investigators, which is examined and analyzed by forensic information experts. At the time of obtaining the proof has been cited as the most critical moment in the CoC, because it is the most vulnerable point. If that initial moment is contaminated, the CoC will be invalid and the evidence could be invalided for a judicial process. Once the evidence has been obtained, it must be treated with all security guarantees. Sharing the evidence with correct treatment will be required for the validity of the process. On the other hand, to obtain the exact capture position and time, Global Positioning Satellite (GPS) has been proposed to be used by some authors. GPS has been demonstrated vulnerable but this is the only solution nowadays. The current technology could allow the automation of tasks and routines as to capture proofs and to start the chain. Then, a tool as Android application is proposed for testing (running on a smartphone device). Once it is analyzed on a mobile, it is proposed for integration in a new device based on very low cost personal computer. In this work, a procedure and a tool are proposed to guarantee the Chain of Custody.