[Paper Review] Leveraging Decentralization to Extend the Digital Evidence Acquisition Window: Case Study on BitTorrent Sync

Mark Scanlon, Jason Farina+2 more|Sep 30, 2014

Digital and Cyber Forensics1 references4 citations

TL;DR

This paper proposes a forensically sound methodology for remotely recovering and verifying digital evidence from decentralized file synchronization services like BitTorrent Sync, leveraging native hash-based integrity checks to ensure authenticity. The approach enables recovery of deleted or inaccessible files from peer devices, with proof-of-concept validation showing successful reconstruction of original files using SHA1-based verification.

ABSTRACT

File synchronization services such as Dropbox, Google Drive, Microsoft OneDrive, Apple iCloud, etc., are becoming increasingly popular in today's always-connected world. A popular alternative to the aforementioned services is BitTorrent Sync. This is a decentralized/cloudless file synchronization service and is gaining significant popularity among Internet users with privacy concerns over where their data is stored and who has the ability to access it. The focus of this paper is the remote recovery of digital evidence pertaining to files identified as being accessed or stored on a suspect's computer or mobile device. A methodology for the identification, investigation, recovery and verification of such remote digital evidence is outlined. Finally, a proof-of-concept remote evidence recovery from BitTorrent Sync shared folder highlighting a number of potential scenarios for the recovery and verification of such evidence.

Motivation & Objective

• To address the challenge of recovering digital evidence from decentralized file synchronization services after local data is lost or deleted.
• To develop a forensically sound remote acquisition method that ensures evidence integrity and authenticity.
• To demonstrate the feasibility of recovering evidence from BitTorrent Sync using peer-to-peer network interactions.
• To verify recovered evidence using native protocol-level hashing mechanisms to confirm fidelity to original files.
• To provide a framework applicable to other decentralized synchronization networks such as Syncthing and ownCloud.

Proposed method

• The methodology uses known peer IP addresses to initiate remote file downloads from synchronized devices, bypassing authentication requirements.
• It disables all peer discovery methods except 'Known Peers' to control and isolate the evidence acquisition process.
• File integrity is verified using SHA1 hashing of file pieces, with each piece's hash compared against the original stored in the ShareID.db database.
• The protocol's native use of SHA1 for piece-level verification enables detection of corrupted or tampered downloads.
• The approach relies on log analysis (e.g., sync.log) and database inspection (e.g., ShareID.db) to identify deleted or modified files.
• A forensically sound evidence recovery machine is used to ensure chain-of-custody and prevent contamination.

Experimental results

Research questions

• RQ1 Can digital evidence be reliably recovered from decentralized file synchronization services after local deletion or device compromise?
• RQ2 How can the integrity of remotely acquired evidence be verified without relying on client-side authentication?
• RQ3 What role do native protocol-level hashing mechanisms play in ensuring the authenticity of recovered data?
• RQ4 How can forensic investigators identify and access remote copies of files that are no longer present on the suspect’s local device?
• RQ5 To what extent can this methodology be generalized to other decentralized synchronization networks?

Key findings

• The proof-of-concept successfully recovered a deleted file, badfilethree.txt, from a remote peer (ComputerA), with a matching SHA1 hash of 3598492B4D1CE5FAFD9EF76E8FA54C8F55E0716A.
• The recovery process was verified using the native BitTorrent Sync protocol’s piece-level hashing, ensuring data fidelity.
• The method enabled identification of deleted files through log and database analysis, including the invalidated tag in ShareID.db.
• The approach supports recovery of data that has been locally deleted from mobile devices, such as photos and videos synced via BTSync.
• The reliance on frequent hashing in decentralized networks provides a robust mechanism for evidence verification and comparison against known malicious hash values.
• Limitations include the risk of remote hosts disconnecting upon detecting suspicious IPs and the potential for data loss if evidence is deleted from all peers before acquisition.