An AutoTriage B-CoC model in digital forensic investigation

With the high technologies are wildly adopted in illicit activities, the high volume and complexity of digital evidence make the collection task at the crime scene a great challenge. Triage is a well-known solution to give a quick review and prioritize the data regarding the admissibility of digital evidence. However, conducting triage at the crime scene may lead to evidence contamination due to limited time, space and human resources. And these common vital mistakes are fatal to the prosecution. In order to facilitate the effectiveness of the on-scene criminal investigation, we propose an AutoTriage B-CoC model to support automatic triage collecting and blockchain uploading. The superior accuracy and completeness of the digital evidence can be achieved without human interfering. The experimental results show that the on-scene examiner can manage the preservation and collection of digital evidence by typing two key values, CaseID and EvidenceID. We expect the detailed design of operations regarding to four phases, i.e. Triage, Documentation, Blockchain and Report, can provide important guidance for further practical applications.