The Forensic Analysis of a False Digital Alibi

Abstract

In recent years the relevance of digital evidence in Courts disputes is growing up and many cases have been solved thanks to digital traces that addressed investigations on the right way. Actually in some cases digital evidence represented the only proof of the innocence of the accused. In such a case this information constitutes a digital alibi. It usually consists of a set of local and Internet activities performed through a digital device. It has been recently shown how it is possible to setup a common PC in order to produce digital evidence in an automatic and systematic manner. Such traces are indistinguishable upon a forensic post-mortem analysis from those left by human activity, thus being exploitable to forge a digital alibi. In this paper we verify the undetectability of a false digital alibi by setting up a challenge. An alibi maker team set up a script which simulated some human activities as well as a procedure to remove all the traces of the automation including itself. The verification team received the script and executed it on its own PCs. The verification team could perform not only a usual post-mortem analysis but also a deeper forensic analysis. Indeed, they knew all the details of the script and the original state of the PC before running it. The verification confirmed that a well-constructed false digital alibi is indistinguishable from an alibi based on human activities.