An automatic e-evidence archival system
Chokdee Liophanich · 2005
This paper proposes the development of an automatic e-evidence archival system. It acts as a trusted third party (TTP), which collects, filters, time-stamps, and records Web contents and contexts passing through it both proactively and reactively. E-evidence can then be retrieved from any Web sites at any event points, thus facilitating case evidence referencing. However, this evidence archival process may easily cause information overload. The proposed data reduction technique, CheckDup, is required to manage the voluminous e-evidence data to the manageable amount. Information retrieval may be context-based or content-based. Context-based retrieval requires event time, URL, and the client's IP address, whereas content-based retrieval may be accomplished via free-text search. A verification process compares hash codes kept in the database and the regenerated ones from the just-retrieved Web page. Data integrity is confirmed, should the comparison result shows similar hash codes. The system's primary benefit is its ability to store and furnish relevant evidence for the settlement of e-business disputes in a proactive and reactive manner.