A Comprehensive Forensic Preservation Methodology for Crypto Wallets

Studies have shown that the existing methodology of digital forensics preservation, which is to acquire and hash the evidence, is insufficient for cryptocurrencies as it does not secure the value. To address this issue, investigators secure the cryptocurrency by transferring it to a crypto wallet controlled by the Law Enforcement Agencies(LEAs). This process will unavoidably modify some data. Despite the criticality of this issue, inadequate studies have been made in this area. In addition, current guidelines on securing the cryptocurrency lack a comprehensive description from the perspective of digital evidence preservation principles. Crucial data to be documented throughout the preservation process were also not properly listed. Therefore, this study aims to address the gap in preserving cryptocurrencies from crypto wallets. Three objectives were then laid out; (1) to develop a methodology that is mapped comprehensively with digital evidence preservation principle, (2) to describe and provide justification on the inevitably modified data, and (3) to list crucial data to be documented during preservation process. The methods to achieve the objectives were critical examinations on various types of crypto wallets and by using simulation. The result shows that the study is able to provide a comprehensive crypto wallets preservation methodology to forensic investigators. It is hoped that the outcome from this study will promote better understanding, ensure consistency of implementation, and to aid investigators in explaining and justifying their actions during search and seizure in court.