Digital Evidence Bag Selection for P2P Network Investigation
Mark Scanlon, M-Tahar Kechadi

TL;DR
This paper compares digital evidence formats and introduces a new extended evidence bag tailored for P2P network evidence, enhancing collection, identification, and analysis processes.
Contribution
It proposes a novel digital evidence bag specifically designed for P2P network evidence, integrating network byte streams and dynamic metadata generation.
Findings
Enhanced evidence collection for P2P networks
Improved identification and analysis efficiency
Compatibility analysis of existing evidence formats
Abstract
The collection and handling of court admissible evidence is a fundamental component of any digital forensic investigation. While the procedures for handling digital evidence take much of their influence from the established policies for the collection of physical evidence, due to the obvious differences in dealing with non-physical evidence, a number of extra policies and procedures are required. This paper compares and contrasts some of the existing digital evidence formats or "bags" and analyses them for their compatibility with evidence gathered from a network source. A new digital extended evidence bag is proposed to specifically deal with evidence gathered from P2P networks, incorporating the network byte stream and on-the-fly metadata generation to aid in expedited identification and analysis.
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsDigital and Cyber Forensics · Advanced Malware Detection Techniques · Privacy, Security, and Data Protection
