See discussions, stats, and author profiles for this publication at: https://www.researchgate.

net/publication/321698383

Darknet Forensics

Article · July 2017

CITATIONS READS

3 6,887

1 author:

Digvijaysinh M Rathod
Gujarat Forensic Sciences University
17 PUBLICATIONS   76 CITATIONS   

SEE PROFILE

Some of the authors of this publication are also working on these related projects:

digital forensics View project

All content following this page was uploaded by Digvijaysinh M Rathod on 09 December 2017.

The user has requested enhancement of the downloaded file.

 International Journal of Emerging Trends & Technology in Computer Science (IJETTCS)
Web Site: www.ijettcs.org Email: [email protected]
Volume 6, Issue 4, July- August 2017 ISSN 2278-6856

Darknet Forensics
Dr. Digvijaysinh Rathod
Institute of Forensic Science, Gujarat Forensic Sciences University, Inida

Abstract web pages (requires complete URL to access it), Non-

Deep web content cannot be indexed by search engine such as HTML or scripted content, and a network which in not
Google, Yahoo and Bing and darknet is lies within the deep open for every user.
web. Dark web has been intentionally hidden and it is not
accessible through standard browser. Deep web can be accessed Darknet sites are hosted with Domain Name System(DNS)
by anyone who has The Onion Router (TOR) browser. TOR is a
virtual and encrypted tunnel which allows people to hide their
root such as .BIT domains which are not controlled or
identity and network traffic, and allow them to use internet managed by Internet Corporation for Assigned Names and
anonymously. Dark web is virtually online market for anything, Numbers ICANN and such sites hosted on limited-access
including but not limited to drugs, weapons, credit card data, network infrastructure requires special software - TOR to
forged documents, hire services for murder, narcotics and access it. Anyone can share,, communicate and disseminate
indecent pornography etc,. Because of these reasons, it is ideas through the Internet but because of the darknet,
difficult for law enforcement agencies or digital forensic
professionals to pinpoint the origin of traffic, location or
despite many advantages of internet; terrorist groups,
ownership of any computer or person on the dark net. There extremist groups, hate organizations and cybercrime
has been lot of buzz around Bitcoin, TOR network and darknet, criminals are using darknet to conduct criminal activities,
because most of the darknet sites carried out transactions promote their ideology or selling services or goods such as
through anonymous digital currency, pear to peer, distributed drug, weapon credit card data, forged documents, hire
and Bitcoin which is based on cryptography principal. In this services for murder, narcotics and indecent pornography
research paper, I proposed darknet forensics techniques, which
is a combination of TOR browser and Bitcoin wallet forensics. I
etc [5],. Anybody who wants to access any content from
am also proposed and discussed different technique to retrieve the dark net, need not to type keywords in a regular
evidences from TOR browser and Bitcoin wallet, which helps browser but will need to access it anonymously using TOR
digital forensics professional to perform darknet forensics. browser, which hide his/her identity such as IP address or
physical location. Because of these reasons, it is difficult
Keywords: Deep web, Darknet, Bitcoin, TOR, Onion for law enforcement agencies or digital forensic
sites, RAM forensics, Bitcoin wallet professional to pinpoint the origin of traffic, location or
ownership of any computer or person on the dark net.
Implication of darknet comes in picture when Federal
1. INTRODUCTION Bureau of Investigation (FBI) shutdown the website – silk
Internet can be broadly divided in surface web or clear web road on October, 2013, which was an online black market
and deep web, shown in figure-1. The surface web or clear and first modern darknet market for selling illegal drugs
web consist of web pages or web content which will be [6,7]. Silk Road was only accessible via the TOR network
indexed by the popular search engine such as Google or and hidden from mainstream web. There has been lot of
Yahoo and accessible through standard browser without buzz around Bitcoin, TOR network and dark web because
need of any special software and configurations [1]. Deep most of the dark net sites carried out transactions through
web content cannot be indexed by search engine such as anonymous digital currency, pear to peer, distributed and
Google, Yahoo and Bing and, Darknet is lies within the Bitcoin which is based on cryptography principal. It is
Deep web and Darknet is small section of it. Darknet has very difficult for digital forensic professionals to track
been intentionally hidden inside the deep web and cannot such transaction because users and services are
be accessed through standard web browsers because deep anonymous. The aim and objective of this paper is to
web content is not indexed by any of popular web discuss digital forensic techniques to deals with such
browsers. Most of the Darknet content are found on TOR darknet crimes.
network which is anonymous network and this content can
be accessed through TOR browser. TOR is a network of
encrypted, virtual tunnels that allows people to use the
internet anonymously, hiding their identity and network
traffic. Using TOR’s hidden service protocol; people can
also host websites anonymously that are only accessible by
those on the TOR network [2]. Deep web also termed
limited-access network [3] which include private sites
(requires credential to access it), un-linked sites, blocked
sites (requires answer a CAPTCHA to access), dynamic

Volume 6, Issue 4, July – August 2017 Page 77

 International Journal of Emerging Trends & Technology in Computer Science (IJETTCS)
Web Site: www.ijettcs.org Email: [email protected]
Volume 6, Issue 4, July- August 2017 ISSN 2278-6856
decentralized marketplace to buy and sell products
with other users [11, 9].
e. Free Net: Freenet is free software which lets you
anonymously share files, browse and publish
"freesites" (web sites accessible only through Freenet)
and chat on forums, without fear of censorship.
Freenet is decentralized to make it less vulnerable to
attack, and if used in "darknet" mode, where users
only connect to their friends, is very difficult to detect.
Communications by Freenet nodes are encrypted and
are routed through other nodes to make it extremely
difficult to determine who is requesting the
information and what its content is [11, 10].
f. ZeroNet – Based on torrent technology in combination
with Bitcoin encryption, this is a new system which is
not well developed but which I think holds promise for
the future [11, 12].
Figure 1 Overview of Surface web, Deep web and Darknet
3. FRAMEWORK FOR DARK NET FORENSICS:
2. DEEP WEB AND DARKNET TECHNOLOGIES:
The proposed forensic techniques for darknet forensics
Deep web and darknet is not a single location but is categorized in two categories; TOR forensics and
distributed in entire internet and share one thing in Bicoin forensics, as anyone can use darknet using
common – that is, it is hidden from search engine crawlers TOR browser and most of the dark net sites do
and regular internet users. Our research shows that people transaction using Bitcon – digital currency. Proposed
can search darknet sites just typing .onion or .onion sites or techniques for darknet forensics are depicted in Table
finds detail for same on web site such as Tor Hidden Wiki, 1 with techniques, tools and purpose.
Onion.City and DNStats. Users need to use special a. TOR browser forensics: Evidences related to TOR
software and configuration to access it. Few of deep web
browser can be extracted in four different way
or darknet technologies are
i. RAM Forensics: RAM forensics is considered as
a. VPN with TOR: In order to hide the fact that they are volatile memory forensics. Belkasoft RAM capturer
using TOR, some people use VPN in addition to TOR will be used to capture dump of RAM and Hex dump
which is extra level of privacy. will be used to view hexadecimal view of RAM dump.
b. Invisible Internet Project (I2P): It is an anonymous Purpose behind RAM forensics is to extract evidences
overlay network (network within network) to protect related to file types and web sites visited.
communication from dragnet surveillance and ii. Registry changes: Registry forensics will be carried
monitoring by third parties such as ISPs. People will out by the Regshot and extracted evidences provide
use I2P to maintain the privacy of their information related to TOR installation and date of last
communication or activity. People can use I2P for an accessed.
c. email, web browsing, blogging and forum, web site iii. Network forensics: Network forensics will be carried
hosting, file sharing and real-time chating [11, 8]. out by wireshark and network miner and extracted
d. Free Anonymous Internet (FAI): The Free evidences provide information related to web traffic.
Anonymous Internet project (FAI) is a decentralized iv. Database: Places Database of TOR browser is located
‘deep web’ service that is using blockchain technology at \Tor Browser\Browser\TorBrowser\Data\Browser
to create a private, secure, peer-to-peer alternative to \profile.default and database viewer can be used to
the regular World Wide Web. FAI comes view the content of the database.
b. Bitcoin Transaction Forensics: Bitcoin transaction
with its own digital currency based on the Bitcoin
forensics can be carried out by extracting forensic
code, but also enables its users to publish their own
artifacts from installed Bitcoin wallet application on
media content and to browse content posted by others
user’s system. Internet Evidence Finder has the
in complete privacy – without anybody being able to
capability to recover Bitcoin artifacts.
spy on what you are doing. There is even a built-in

Volume 6, Issue 4, July – August 2017 Page 78

 International Journal of Emerging Trends & Technology in Computer Science (IJETTCS)
Web Site: www.ijettcs.org Email: [email protected]
Volume 6, Issue 4, July- August 2017 ISSN 2278-6856

4.Conclusion
Table 1: Darnet Forensics Techniques
Category Techniques Tools Purpose

Belkasoft RAM Detail about file types, web sited visited

RAM forensics
Capturer, Hex dump and other downloaded content

Registry changes Regshot Detail about TOR installation and last

executed date and other attributes
TOR Browser
Forensics
Wireshark and Network
Network forensics Traffic analysis
Miner
To find evidences related to users or
Database viewer
Database visited web content
Bitcoin
Internet Evidence Finder To recover Bitcoin address, Query Bitcoin
transaction Bitcoin wallet
(IEF) block chain
Forensics
[7]. https://geti2p.net/en/
On one hand darknet has been intentionally hidden inside
the deep web and cannot be indexed by search engine and
accessed through TOR browser only and on the other hand
most of the darknet sites carried out the transaction through http://cryptorials.io/free-anonymous-internet-project-
the anonymous digital currency such as Bitcoin. It is browse-publish-shop-in-private/
difficult for digital forensic professionals to track such
dark web activity because users and services are [8]. https://freenetproject.org/pages/about.html
anonymous. Terrorists, cybercrime criminals, extremist [9]. http://cryptorials.io/how-to-access-the-deep-web-or-
groups and hate organization have already been started
darknet-a-beginners-guide/
using dark web to committee cybercrime and this will
increase day by day. I am sure that the forensic techniques [10]. https://github.com/HelloZeroNet/ZeroNet
proposed in this research paper, which is combination of
TOR browser and Bitcoin wallet forensics will helps Major Jeremy Cole, USAF, “Dark Web 101”, AIR &
digital forensic professionals to deals with cybercrime SPACE POWER JOURNAL
cases related to dark web.
References

[1]. https://www.magnetforensics.com/computer-
forensics/bitcoin-forensics-a-journey-into-the-dark-
web/
[2]. Balduzzi M., Ciancaglini V. (Trend Micro),
“Cybercrime in the Deep Web”, Black Hat EU,
Amsterdam 2015.
[3]. https://www.magnetforensics.com/computer-
forensics/bitcoin-forensics-a-journey-into-the-dark-
web/
[4]. Tianjun Fu, Ahmed Abbasi and Hsinchun Chen , “A
Focused Crawler for Dark Web Forums”, JOURNAL

OF THE AMERICAN SOCIETY FOR

INFORMATION SCIENCE AND TECHNOLOGY,
61(6):1213–1231, 2010
[5]. https://www.magnetforensics.com/computer-
forensics/bitcoin-forensics-a-journey-into-the-dark-
web/
[6]. https://en.wikipedia.org/wiki/Silk_Road_(marketplace
)

Volume 6, Issue 4, July – August 2017 Page 79

View publication stats