{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,9]],"date-time":"2026-06-09T15:47:04Z","timestamp":1781020024607,"version":"3.54.1"},"reference-count":53,"publisher":"Springer Science and Business Media LLC","issue":"2","license":[{"start":{"date-parts":[[2025,2,18]],"date-time":"2025-02-18T00:00:00Z","timestamp":1739836800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2025,2,18]],"date-time":"2025-02-18T00:00:00Z","timestamp":1739836800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"funder":[{"DOI":"10.13039\/501100004702","name":"Universit\u00e0 degli Studi di Genova","doi-asserted-by":"crossref","id":[{"id":"10.13039\/501100004702","id-type":"DOI","asserted-by":"crossref"}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Int. J. Inf. Secur."],"published-print":{"date-parts":[[2025,4]]},"abstract":"<jats:title>Abstract<\/jats:title>\n                  <jats:p>The pervasiveness of web-based services has further complicated forensic operations, as traditional acquisition techniques do not fit with the volatile nature of online evidence. The current best practice often suffer from procedural shortcomings and are prone to tampering, which can lead to the dismissal of evidence in legal contexts. This paper introduces an acquisition methodology aimed at improving the integrity and admissibility of digital evidence acquired from live web environments. Our proposed approach addresses these issues and adheres to the requirement of international standards by establishing a unified format as a single source of truth, secure timestamping, and enabling automatic verification of integrity and its content, thereby offering more transparency to the involved parties. An extensive evaluation with live acquisition of the top 100 most popular websites indicates that the methodology produces an artifact comparable to state-of-the-art tools with added benefits.<\/jats:p>","DOI":"10.1007\/s10207-025-00991-8","type":"journal-article","created":{"date-parts":[[2025,2,18]],"date-time":"2025-02-18T09:49:56Z","timestamp":1739872196000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":3,"title":["WEFT: a consistent and tamper-proof methodology for acquisition of automatically verifiable forensic web evidence"],"prefix":"10.1007","volume":"24","author":[{"given":"Alessandro","family":"Cantelli-Forti","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Giacomo","family":"Longo","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Francesco","family":"Lupia","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Enrico","family":"Russo","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2025,2,18]]},"reference":[{"key":"991_CR1","unstructured":"Digital forensics market size & report analysis | 2032, (2023) Accessed: 2023-06-06"},{"key":"991_CR2","doi-asserted-by":"crossref","unstructured":"Akter, Omi, Arnisha Akther, Md., Uddin, Ashraf, Manowarul, M., Islam.: Cloud forensics: Challenges and blockchain based solutions. International Journal of Wireless and Microwave Technologies 10(5), 1\u201312 (2020)","DOI":"10.5815\/ijwmt.2020.05.01"},{"key":"991_CR3","doi-asserted-by":"crossref","unstructured":"Cantelli-Forti, Alessandro, Longo, Giacomo, Russo, Enrico: Work-in-progress: Consistent and tamper-proof acquisition of automatically verifiable forensic web evidence. In 2024 IEEE European Symposium on Security and Privacy Workshops (EuroS &P), page 726\u2013730. IEEE, (2024)","DOI":"10.1109\/EuroSPW61312.2024.00089"},{"key":"991_CR4","unstructured":"Casadio, Emanuele: Kopjra Web Forensics. https:\/\/webforensics.kopjra.com,"},{"key":"991_CR5","doi-asserted-by":"crossref","unstructured":"Casey, Eoghan: Handbook of digital forensics and investigation. Academic Press, (2009)","DOI":"10.1016\/B978-0-12-374267-4.00004-5"},{"key":"991_CR6","doi-asserted-by":"crossref","first-page":"25464","DOI":"10.1109\/ACCESS.2022.3154059","volume":"10","author":"Fran Casino","year":"2022","unstructured":"Casino, Fran, Dasaklis, Thomas K., Spathoulas, Georgios P., Anagnostopoulos, Marios, Ghosal, Amrita, Borocz, Istvan, Solanas, Agusti, Conti, Mauro, Patsakis, Constantinos: Research trends, challenges, and emerging topics in digital forensics: A review of reviews. IEEE Access 10, 25464\u201325493 (2022)","journal-title":"IEEE Access"},{"issue":"4","key":"991_CR7","doi-asserted-by":"crossref","first-page":"425","DOI":"10.1109\/TBDATA.2017.2683521","volume":"5","author":"Aniello Castiglione","year":"2019","unstructured":"Castiglione, Aniello, Cattaneo, Giuseppe, De Maio, Giancarlo, De Santis, Alfredo, Roscigno, Gianluca: A Novel Methodology to Acquire Live Big Data Evidence from the Cloud. IEEE Trans. on Big Data 5(4), 425\u2013438 (2019)","journal-title":"IEEE Trans. on Big Data"},{"key":"991_CR8","volume":"35","author":"Shijie Chen","year":"2020","unstructured":"Chen, Shijie, Zhao, Chengqiang, Huang, Lingling, Yuan, Jing, Liu, Mingzhe: Study and implementation on the application of blockchain in electronic evidence generation. Forensic Science International: Digital Investigation 35, 301001 (2020)","journal-title":"Forensic Science International: Digital Investigation"},{"key":"991_CR9","doi-asserted-by":"crossref","unstructured":"Chopade, Mrunali, Khan, Sana, Shaikh, Uzma, Pawar, Renuka: Digital forensics: Maintaining chain of custody using blockchain. In 2019 Third International conference on I-SMAC (IoT in Social, Mobile, Analytics and Cloud)(I-SMAC), pages 744\u2013747. IEEE, (2019)","DOI":"10.1109\/I-SMAC47947.2019.9032693"},{"issue":"1","key":"991_CR10","first-page":"1","volume":"3","author":"S\u00e9amus \u00d3 Ciardhu\u00e1in","year":"2004","unstructured":"Ciardhu\u00e1in, S\u00e9amus. \u00d3.: An extended model of cybercrime investigations. International Journal of Digital Evidence 3(1), 1\u201322 (2004)","journal-title":"International Journal of Digital Evidence"},{"key":"991_CR11","unstructured":"Comandini, Leonardo: Sign-to-contract: How to achieve trustless digital timestamping with zero marginal cost. Master\u2019s thesis, Politecnico di Milano, (2017)"},{"issue":"6","key":"991_CR12","doi-asserted-by":"crossref","first-page":"60","DOI":"10.1109\/MIC.2002.1067738","volume":"6","author":"Vicka Corey","year":"2002","unstructured":"Corey, Vicka, Peterman, Charles, Shearin, Sybil: Michael S Greenberg, and James Van Bokkelen. Network forensics analysis. IEEE Internet computing 6(6), 60\u201366 (2002)","journal-title":"Network forensics analysis. IEEE Internet computing"},{"key":"991_CR13","unstructured":"Dal Checco, Paolo: Forensic Acquisition of Websites and Webpages - OSDFCON 2021. https:\/\/www.dalchecco.it\/forensic-acquisition-of-websites-and-webpages-osdfcon-2021\/. Accessed on December (2024)"},{"key":"991_CR14","doi-asserted-by":"crossref","unstructured":"Dierks, Tim, Rescorla, Eric: The Transport Layer Security (TLS) Protocol Version 1.1. RFC 4346, April (2006)","DOI":"10.17487\/rfc4346"},{"key":"991_CR15","unstructured":"Wireshark Foundation. Wireshark. https:\/\/www.wireshark.org\/"},{"key":"991_CR16","unstructured":"freedesktop.org. Gstreamer. https:\/\/gstreamer.freedesktop.org, (2024)"},{"key":"991_CR17","unstructured":"freedesktop.org. org.freedesktop.portal.screencast, (2024)"},{"key":"991_CR18","doi-asserted-by":"crossref","unstructured":"Garfinkel, Simson L.: Digital forensics research: The next 10 years. digital investigation, 7:S64\u2013S73, (2010)","DOI":"10.1016\/j.diin.2010.05.009"},{"key":"991_CR19","doi-asserted-by":"crossref","unstructured":"Ghaleb, Taher Ahmed: Website fingerprinting as a cybercrime investigation model: Role and challenges. In 2015 First International Conference on Anti-Cybercrime (ICACC), pages 1\u20135. IEEE, (2015)","DOI":"10.1109\/Anti-Cybercrime.2015.7351934"},{"key":"991_CR20","volume":"49","author":"Jaehyeok Han","year":"2024","unstructured":"Han, Jaehyeok, Han, Mee Lan, Lee, Sangjin, Park, Jungheum: Eco-bag: An elastic container based on merkle tree as a universal digital evidence bag. Forensic Sci. Int.: Digital Investigation 49, 301725 (2024)","journal-title":"Forensic Sci. Int.: Digital Investigation"},{"key":"991_CR21","doi-asserted-by":"crossref","first-page":"S69","DOI":"10.1016\/j.diin.2012.05.006","volume":"9","author":"Christopher Hargreaves","year":"2012","unstructured":"Hargreaves, Christopher, Patterson, Jonathan: An automated timeline reconstruction approach for digital forensic investigations. Digital Investigation 9, S69\u2013S79 (2012)","journal-title":"Digital Investigation"},{"key":"991_CR22","unstructured":"Harris, Guy, Richardson, Michael: PCAP Capture File Format. Internet-Draft draft-ietf-opsawg-pcap-04, Internet Engineering Task Force, August (2024). Work in Progress"},{"key":"991_CR23","unstructured":"ISO\/IEC. ISO\/IEC 27037:2012 Information technology\u2013Security techniques \u2013Guidelines for identification, collection, acquisition and preservation of digital evidence, (2012)"},{"key":"991_CR24","unstructured":"Kessler, Gary: Anti-forensics and the digital investigator. 5th Australian Digital Forensics Conference, Edith Cowan University:December 3rd 2007, (2007)"},{"key":"991_CR25","doi-asserted-by":"crossref","first-page":"214","DOI":"10.1016\/j.jnca.2016.03.005","volume":"66","author":"Suleman Khan","year":"2016","unstructured":"Khan, Suleman, Gani, Abdullah, Wahab, Ainuddin Wahid Abdul., Shiraz, Muhammad, Ahmad, Iftikhar: Network forensics: Review, taxonomy, and open challenges. J. Network and Computer Appl. 66, 214\u2013235 (2016)","journal-title":"J. Network and Computer Appl."},{"issue":"6","key":"991_CR26","doi-asserted-by":"crossref","first-page":"1433","DOI":"10.1109\/TCSS.2019.2927431","volume":"6","author":"Shancang Li","year":"2019","unstructured":"Li, Shancang, Qin, Tao, Min, Geyong: Blockchain-based digital forensics investigation framework in the internet of things and social systems. IEEE Trans. on Computational Social Systems 6(6), 1433\u20131441 (2019)","journal-title":"IEEE Trans. on Computational Social Systems"},{"key":"991_CR27","unstructured":"Linux man-pages maintainers. packet(7) - Linux manual page"},{"key":"991_CR28","unstructured":"Envolve\u00a0Forensics LTD. FAW - Forensics Acquisition of Websites. https:\/\/www.fawproject.com"},{"issue":"4","key":"991_CR29","doi-asserted-by":"crossref","first-page":"237","DOI":"10.1016\/S1355-0306(03)71783-3","volume":"43","author":"AM Marshall","year":"2003","unstructured":"Marshall, A.M.: An improved protocol for the examination of rogue www sites. Science & Justice 43(4), 237\u2013248 (2003)","journal-title":"Science & Justice"},{"key":"991_CR30","unstructured":"Melnikov, Alexey, Fette, Ian: The WebSocket Protocol. RFC 6455, December (2011)"},{"issue":"3","key":"991_CR31","doi-asserted-by":"crossref","first-page":"193","DOI":"10.1016\/j.diin.2005.08.001","volume":"2","author":"Bruce J Nikkel","year":"2005","unstructured":"Nikkel, Bruce J.: Generalizing sources of live network evidence. Digital Investigation 2(3), 193\u2013200 (2005)","journal-title":"Digital Investigation"},{"key":"991_CR32","doi-asserted-by":"crossref","unstructured":"Nikkel, Bruce J.: A portable network forensic evidence collector. digital investigation, 3(3):127\u2013135, (2006)","DOI":"10.1016\/j.diin.2006.08.012"},{"key":"991_CR33","unstructured":"Ottmann, Jenny, Breitinger, Frank, Freiling, Felix: Defining Atomicity (and Integrity) for Snapshots of Storage in Forensic Computing. March (2022)"},{"key":"991_CR34","doi-asserted-by":"crossref","unstructured":"Ottmann, Jenny, Breitinger, Frank, Freiling, Felix: An Experimental Assessment of Inconsistencies in Memory Forensics. ACM Trans. Priv. Secur., 27(1):2:1\u20132:29, (2023)","DOI":"10.1145\/3628600"},{"key":"991_CR35","doi-asserted-by":"crossref","unstructured":"Pagani, Fabio, Fedorov, Oleksii, Balzarotti, Davide: Introducing the Temporal Dimension to Memory Forensics. ACM Trans. Priv. Secur., 22(2):9:1\u20139:21, (2019)","DOI":"10.1145\/3310355"},{"key":"991_CR36","doi-asserted-by":"crossref","unstructured":"Pilli, Emmanuel S., Joshi, Ramesh C., Niyogi, Rajdeep: Network forensic frameworks: Survey and research challenges. digital investigation, 7(1-2):14\u201327 (2010)","DOI":"10.1016\/j.diin.2010.02.003"},{"key":"991_CR37","unstructured":"PipeWire. Pipewire project. https:\/\/pipewire.org\/, (2024)"},{"issue":"5","key":"991_CR38","first-page":"1","volume":"114","author":"Yudi Prayudi","year":"2015","unstructured":"Prayudi, Yudi, Azhari, S.N.: Digital chain of custody: State of the art. Int. J. Computer Appl. 114(5), 1\u20139 (2015)","journal-title":"Int. J. Computer Appl."},{"key":"991_CR39","unstructured":"Rasmi, Mohammad, Jantan, Aman, Al-Mimi, Hani: A new approach for resolving cyber crime in network forensics based on generic process model. In The 6th International Conference on Information Technology (ICIT 2013). Citeseer, (2013)"},{"key":"991_CR40","doi-asserted-by":"crossref","unstructured":"Rescorla, Eric: The Transport Layer Security (TLS) Protocol Version 1.3. RFC 8446, August (2018)","DOI":"10.17487\/RFC8446"},{"key":"991_CR41","unstructured":"Rescorla, Eric, Dierks, Tim: The Transport Layer Security (TLS) Protocol Version 1.2. RFC 5246, August (2008)"},{"key":"991_CR42","doi-asserted-by":"crossref","unstructured":"Ruth, Kimberly, Fass, Aurore, Azose, Jonathan, Pearson, Mark, Thomas, Emma, Sadowski, Caitlin, Durumeric, Zakir: A world wide view of browsing the world wide web. In Proceedings of the 22nd ACM Internet Measurement Conference, IMC \u201922. ACM, October (2022)","DOI":"10.1145\/3517745.3561418"},{"key":"991_CR43","doi-asserted-by":"crossref","unstructured":"Schatz, Bradley, Mohay, George, Clark, Andrew: A correlation method for establishing provenance of timestamps in digital evidence. digital investigation, 3:98\u2013107 (2006)","DOI":"10.1016\/j.diin.2006.06.009"},{"key":"991_CR44","doi-asserted-by":"crossref","unstructured":"Sikos, Leslie F.: Packet analysis for network forensics: A comprehensive survey. Forensic Sci. Int.: Digital Investigation 32, 200892 (2020)","DOI":"10.1016\/j.fsidi.2019.200892"},{"key":"991_CR45","volume":"46","author":"Radina Stoykova","year":"2023","unstructured":"Stoykova, Radina: Encrochat: The hacker with a warrant and fair trials? Forensic Science International: Digital Investigation 46, 301602 (2023)","journal-title":"Forensic Science International: Digital Investigation"},{"key":"991_CR46","unstructured":"Thomson, Martin: The SSLKEYLOGFILE Format for TLS. Internet-Draft draft-ietf-tls-keylogfile-01, Internet Engineering Task Force, April (2024). Work in Progress"},{"key":"991_CR47","doi-asserted-by":"crossref","unstructured":"Tian, Zhihong, Li, Mohan, Qiu, Meikang, Sun, Yanbin, Shen, Su.: Block-def: A secure digital evidence framework using blockchain. Information Sciences 491, 151\u2013165 (2019)","DOI":"10.1016\/j.ins.2019.04.011"},{"key":"991_CR48","unstructured":"T\u00fcxen, Michael, Risso, Fulvio, Bongertz, Jasper, Combs, Gerald, Harris, Guy, Chaudron, Eelco, Richardson, Michael: PCAP Next Generation (pcapng) Capture File Format. Internet-Draft draft-ietf-opsawg-pcapng-02, Internet Engineering Task Force, August (2024). Work in Progress"},{"key":"991_CR49","doi-asserted-by":"crossref","unstructured":"Vaghela, Rajdipsinh, Gowda, V Dankan, Taj, Mohammad, Arudra, Annepu, Chopra, Manoj: Digital evidence collection and preservation in computer network forensics. In Handbook of Research on Innovative Approaches to Information Technology in Library and Information Science, pages 42\u201362. IGI Global, (2024)","DOI":"10.4018\/979-8-3693-0807-3.ch003"},{"key":"991_CR50","unstructured":"Valin, Jean-Marc, Vos, Koen, Terriberry, Timothy B.: Definition of the Opus Audio Codec. RFC 6716, September (2012)"},{"key":"991_CR51","doi-asserted-by":"crossref","unstructured":"Westin, Patrik, Lundin, Henrik, Glover, Michael, Uberti, Justin, Galligan, Frank: RTP Payload Format for VP8 Video. RFC 7741, March (2016)","DOI":"10.17487\/RFC7741"},{"key":"991_CR52","unstructured":"Zainudin, Norulzahrah\u00a0Mohd, Merabti, Madjid, Llewellyn-Jones, David: A digital forensic investigation model and tool for online social networks. In 12th Annual Postgraduate Symposium on Convergence of Telecommunications, Networking and Broadcasting (PGNet 2011), Liverpool, UK, pages 27\u201328, (2011)"},{"key":"991_CR53","unstructured":"Zito, Fabio: Freezing internet tool. https:\/\/github.com\/fit-project\/fit, (2024)"}],"container-title":["International Journal of Information Security"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10207-025-00991-8.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s10207-025-00991-8\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10207-025-00991-8.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,3,30]],"date-time":"2025-03-30T04:04:44Z","timestamp":1743307484000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s10207-025-00991-8"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,2,18]]},"references-count":53,"journal-issue":{"issue":"2","published-print":{"date-parts":[[2025,4]]}},"alternative-id":["991"],"URL":"https:\/\/doi.org\/10.1007\/s10207-025-00991-8","relation":{"has-preprint":[{"id-type":"doi","id":"10.21203\/rs.3.rs-5012741\/v1","asserted-by":"object"}]},"ISSN":["1615-5262","1615-5270"],"issn-type":[{"value":"1615-5262","type":"print"},{"value":"1615-5270","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,2,18]]},"assertion":[{"value":"18 February 2025","order":1,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"The authors declare no Conflict of interest, financial or otherwise.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Conflict of interest"}}],"article-number":"81"}}