DIGITAL EVIDENCE IN THE INVESTIGATION OF COMPUTER CRIMES: A FORMAL MODEL OF THE CHAIN OF CUSTODY AND A COMPARATIVE ANALYSIS OF ATTRIBUTION METHODS
Abstract
This article examines the evidentiary stage of the response to computer crime, at which a technically established fact must be converted into a fact admissible in criminal proceedings. A five-stage model of the handling of digital evidence — identification, collection, preservation, analysis and presentation — is constructed, and the continuity of custody is formalised as a chain of cryptographic hash commitments in which every transfer between custodians is bound to a verified value. Admissibility is stated as a conjunction of four conditions covering the lawfulness of acquisition, the integrity of the object, the reproducibility of the method and the demonstrability of the inference, and it is shown that integrity alone, which receives the greatest technical attention, satisfies only one of them.
References
1. Internet Crime Report 2025. – Washington: Internet Crime Complaint Center, Federal Bureau of Investigation, 2026.
2. On the state of crime in the sphere of information technologies: data of the Ministry of Internal Affairs of the Republic of Uzbekistan for 2019–2024. – Tashkent, 2025.
3. Cost of a Data Breach Report 2026. – Armonk: IBM Security, 2026.
4. Palmer G. A Road Map for Digital Forensic Research: Report from the First Digital Forensic Research Workshop (DFRWS). – Utica, New York, 2001. – 48 p.
5. Casey E. Digital Evidence and Computer Crime: Forensic Science, Computers and the Internet. 3rd ed. – Waltham: Academic Press, 2011. – 840 p.
6. Kent K., Chevalier S., Grance T., Dang H. Guide to Integrating Forensic Techniques into Incident Response: NIST Special Publication 800-86. – Gaithersburg: National Institute of Standards and Technology, 2006. – 121 p.
7. ISO/IEC 27037:2012. Information technology — Security techniques — Guidelines for identification, collection, acquisition and preservation of digital evidence. – Geneva: ISO, 2012. – 46 p.
8. ISO/IEC 27043:2015. Information technology — Security techniques — Incident investigation principles and processes. – Geneva: ISO, 2015. – 30 p.
9. Garfinkel S.L. Digital forensics research: The next 10 years // Digital Investigation. – 2010. – Vol. 7, Supplement. – P. S64–S73.
10. Rid T., Buchanan B. Attributing Cyber Attacks // Journal of Strategic Studies. – 2015. – Vol. 38, No. 1–2. – P. 4–37.
11. Harris R. Arriving at an anti-forensics consensus: Examining how to define and control the anti-forensics problem // Digital Investigation. – 2006. – Vol. 3, Supplement. – P. 44–49.
12. Convention on Cybercrime, ETS No. 185. – Budapest: Council of Europe, 23 November 2001.
13. United Nations Convention against Cybercrime: adopted by General Assembly resolution 79/243 of 24 December 2024, opened for signature at Hanoi on 25 October 2025. – New York: United Nations, 2025.
14. Code of Criminal Procedure of the Republic of Uzbekistan of 22 September 1994, No. 2013-XII (as amended). – URL: https://lex.uz/docs/111463
15. Criminal Code of the Republic of Uzbekistan of 22 September 1994, No. 2012-XII (as amended), Chapter XX¹, Articles 278¹–278⁶. – URL: https://lex.uz/docs/111457
16. On Cybersecurity: Law of the Republic of Uzbekistan of 15 April 2022, No. ZRU-764. – National Database of Legislation of the Republic of Uzbekistan, No. 03/22/764/0330.
17. On Informatisation: Law of the Republic of Uzbekistan of 11 December 2003, No. 560-II (as amended). – URL: https://lex.uz/ru/docs/82956
18. On Personal Data: Law of the Republic of Uzbekistan of 2 July 2019, No. ZRU-547 (as amended). – URL: https://lex.uz/ru/docs/4396428
19. On the Strategy of Development of New Uzbekistan for 2022–2026: Decree of the President of the Republic of Uzbekistan of 28 January 2022, No. UP-60. – URL: https://lex.uz/docs/5841063
20. Carrier B. File System Forensic Analysis. – Upper Saddle River: Addison-Wesley, 2005. – 600 p.
21. Ayers R., Brothers S., Jansen W. Guidelines on Mobile Device Forensics: NIST Special Publication 800-101, Rev. 1. – Gaithersburg: National Institute of Standards and Technology, 2014. – 85 p.
22. Comprehensive Study on Cybercrime. – Vienna: United Nations Office on Drugs and Crime, 2013. – 320 p.
23. Quick D., Choo K.-K.R. Big forensic data reduction: digital forensic images and electronic evidence // Cluster Computing. – 2016. – Vol. 19, No. 2. – P. 723–740.
24. ENISA Threat Landscape 2025. – Athens: European Union Agency for Cybersecurity, 2025.
