Representing Chains of Custody Along a Forensic Process: A Case Study on Kruse Model

摘要

Chains of Custody (CoCs) are tangible documents accompanying the evidences along the forensic process. They play vital role in the forensics investigation by demonstrating the road map of Who exactly, When, Where, Why, What, and How came into contact with the evidences in order to prosecute them in a court of law. In the cyber forensic, the evidences have digital nature; the fact that can make them easily altered and loses their values. With the advent of digital age, and the poor awareness of juries to understand digital evidences, CoC documents need to undergo a radical transformation from paper to electronic data (e-CoC) readable, discoverable, understandable, and consumable by people and computers. The semantic web is a fertile land to represent and manage the tangible CoCs because it uses web principles known as Linked Data Principles (LDP) which provides useful information in RDF upon URI resolution. These principles are used to publish data publicly on the web and provide a standard framework that allows such data to be shared, and consumed in a machine readable format. This paper provides a case study applied on a cyber forensic model, such as Kruse model, explaining how these principles are applied to represent chains of custody for this model, and how the e-CoCs are customized to be used on a small scale using public key infrastructure approach (PKI), where the role players and juries are the only people who are authorized to respectively publish and consume this e-CoC.