A Blockchain-Based Model Proposal to Enhance Digital Forensics Readiness

Effective incident response mechanisms are crucial for maintaining system continuity during security incidents. Equally important is the secure preservation of forensic evidence and chain of custody records for potential legal proceedings. However, traditional methods of incident response and evidence handling can be vulnerable to tampering as they rely on the assumption of a pre-existing level of trust among the involved parties. In this study, we propose a blockchain-based model, DFIRChain, to record all operations within digital forensics and incident response (DFIR) processes on a private permissioned Hyperledger Fabric blockchain, from alert management to case management. By integrating our blockchain-based model into DFIR processes, we aim to ensure the integrity and authenticity of evidence, enhance legal compliance, and contribute to organizations' digital forensic readiness.