Validity of Forensic Evidence using Hash Function

• Published in: 2020 5th International Conference on Communication and Electronics Systems (ICCES) pp. 823 - 826
• Main Authors: K.C., Pradeep, Soman, Rajashree, Honnavalli, Prasad
• Format: Conference Proceeding
• Language: English
• Published: IEEE 01.06.2020
• Subjects: Cryptography; Cyber forensics; Digital forensics; Drives; Hard disks; Hash functions; Hashing; Program processors; Real-time systems; Resistance; Salt; SHA-1; SHA-2; SHA-3; Surveillance
• DOI: 10.1109/ICCES48766.2020.9138061

In any crime scene, the cyber forensics team look out for various evidences. In particular, they seek digital evidences such as surveillance system, hard disk drives, pen drives, and so on. After gathering the necessary evidences, they produce an exact copy of the evidence, called the forensics copy, rather than the original copy. This is done to avoid the destruction of original evidence. During the course of the investigation, the evidences may go through several phases. At any point of time, the investigator must be completely sure that the evidence is the exact same copy of the forensics copy. Hash functions play a very crucial role in this regard. They are used to verify whether the evidence has been subject to some unauthorized manipulation. SHA-1 and SHA-2 has been among the widely used hash functions. But nowadays, SHA-1 is considered weak. Furthermore, although SHA-3 is more secure than its earlier counterparts, it is considered to be slow on general purpose processors and as such, they are not so popular as yet. In this context, this assignment proposes a simple, but effective mechanism to fulfill the needs of cyber forensics using the combined capabilities of hashing functions, along with other cryptography concepts such as SALT.