Why use blockchain in forensics?
The SEC Consult SEC Defense team uses various forensic tools to analyze cyber incidents. With more and more analyses done, the challenge arises that the results can also be used as evidence in court. An important part of these activities is the secure copying of data images, also called forensic imaging. Forensic imaging is carried out using so-called write blockers. There are different types of hardware write block devices that support different types of storage media such as SATA, SAS, IDE USB, memory cards and others.
The process itself is done using imaging software. This software reads the source image through the write blocker onto a target device. At the same time, it also calculates a digital fingerprint, typically using a recognized hash signature. The digital fingerprint can be saved on any data medium in any format and is, therefore, theoretically changeable. This means that images could be manipulated afterward, and the stored fingerprint could be swapped for a new one.