Incollection
Digital Evidence Bag Selection for P2P Network Investigation
Contribution Summary
This paper presents a new digital evidence bag format specifically designed for P2P network investigations. The existing digital evidence formats or 'bags' are compared and contrasted for their compatibility with evidence gathered from a network source. A new digital extended evidence bag is proposed to store the captured packets alongside useful metadata, aiding the investigator in identifying and analyzing the network traffic. The proposed format addresses the limitations of existing formats in handling network traffic and metadata, making it an essential tool for time-sensitive and high-traffic network investigations.
Keywords: Digital Evidence Bag; P2P Network Investigation; Network Traffic Analysis; Metadata Generation; Digital Forensics; Evidence Handling; Peer-to-Peer Networks; Network Byte Streams
Abstract
The collection and handling of court admissible evidence is a fundamental component of any digital forensic investigation. While the procedures for handling digital evidence take much of their influence from the established policies for the collection of physical evidence, due to the obvious differences in dealing with non-physical evidence, a number of extra policies and procedures are required. This paper compares and contrasts some of the existing digital evidence formats or ”bags” and analyses them for their compatibility with evidence gathered from a network source. A new digital extended evidence bag is proposed to specifically deal with evidence gathered from P2P networks, incorporating the network byte stream and on-the-fly metadata generation to aid in expedited identification and analysis.
BibTeX
@incollection{scanlon2014p2pevidencebag,
title="{Digital Evidence Bag Selection for P2P Network Investigation}",
author={Scanlon, Mark and Kechadi, M-Tahar},
booktitle="{Proceedings of the 7th International Symposium on Digital Forensics and Information Security (DFIS-2013), Future Information Technology, Application, and Service}",
pages={307-314},
year=2014,
month=07,
address={Gwangju, South Korea},
publisher={Springer},
abstract="The collection and handling of court admissible evidence is a fundamental component of any digital forensic investigation. While the procedures for handling digital evidence take much of their influence from the established policies for the collection of physical evidence, due to the obvious differences in dealing with non-physical evidence, a number of extra policies and procedures are required. This paper compares and contrasts some of the existing digital evidence formats or ''bags'' and analyses them for their compatibility with evidence gathered from a network source. A new digital extended evidence bag is proposed to specifically deal with evidence gathered from P2P networks, incorporating the network byte stream and on-the-fly metadata generation to aid in expedited identification and analysis.",
doi={10.1007/978-3-642-40861-8_44},
}