Securing digital evidence

摘要: Trusted Computing as defined by the Trusted Computing Group is aimed to provide a trusted platform that can attest to its current configuration to a third party. The functionality behind is a Trusted Platform Module (TPM). We use this functionality to provide trustworthy digital evidence collected in an automated process. Digital evidence like measurements, photos, or documents is not a priori seen as trustworthy since it is only existent in binary representation. Therefore, modifications and tampering of the collected data is easy but also hard to detect. Faults in trial are difficult to cope with and so lead to an enforcement of high security policies. Since courts are now dealing more and more with evidence in digital form they require for integrity and authenticity of digital evidence. The unambiguous identification of a person or entity performing an action must be warranted. Moreover, it should not be possible to tamper data at any time since its creation. Because handling of digital evidence can cause many problems it requires appropriate methods to securely acquire information and present them in court.In this thesis, a concept of a protected environment that automatically collects and secures digital evidence is created. In order to achieve the admissibility of digital evidence in a court of law, the integrity of the system is checked and document and the collected data is furnished with additional security information. Security information comprising for example hash values, signatures, configuration status values and retraceable certified time stamps. In particular, a method for the acquisition of a certified platform independent time stamps is developed …