Illicit Cryotocurrency Investigation Digital Forensic Framework: Integrating Off-chain and On-Chain Analysis for Two Types of Crime
DOI:
https://doi.org/10.62146/ijecbe.v3i2.135Keywords:
Digital Forensic, Cryptocurrency, On-Chain, Off-Chain, Cybercrime, Blockchain InvestigtionsAbstract
Cryptocurrencies have emerged as integral components of modern financial ecosystems, yet their pseudonymous nature poses significant challenges for digital crime investigations. This study proposes the Illicit Cryptocurrency Investigation Digital Forensic Framework, a novel model that integrates both on-chain and off-chain forensic techniques into a cohesive investigative process. Unlike prior research that treats blockchain analysis and conventional digital forensics separately, this framework combines blockchain transparency with contextual digital artifacts to form a unified approach. Validated by expert judgement from digital forensic practitioners, the framework is designed to address two primary crime scenarios: Type A, where investigations begin with suspect-owned devices; and Type B, where blockchain transactions provide the first investigative lead. The framework’s structured process—from identification to reporting—ensures evidentiary integrity, traceability, and legal admissibility. Beyond its practical application, the study lays groundwork for future developments, including the integration of artificial intelligence and cross-border legal interoperability in cryptocurrency-related crime investigations
References
C. Chitsungo, “Harnessing Digital Strategies to Combat Cryptocurrency-Enabled Crimes: Addressing Money Laundering, Illicit Trade, and Cyber Threats,” American Journal of International Relations, vol. 9, no. 7, pp. 77–106, Nov. 2024, doi: 10.47672/ajir.2523.
“The 2025 Crypto Crime Report,” Feb. 2025.
J. and G. X. and C. Z. and L. Y. Chen Weili and Cui, “Misbehavior Detection on Blockchain Data,” in Blockchain Intelligence: Methods, Applications and Challenges, H.-N. and W. J. Zheng Zibin and Dai, Ed., Singapore: Springer Singapore, 2021, pp. 95–133. doi: 10.1007/978-981-16-0127-9_5.
N. Mungoli, “Deciphering the Blockchain: A Comprehensive Analysis of Bitcoin’s Evolution, Adoption, and Future Implications,” Apr. 2023, [Online]. Available: http://arxiv.org/abs/2304.02655
K. Gagneja, A. Goode, D. Rentos, and K. Rezk, “Traceability of cryptocurrency transactions using blockchain analytics,” International Journal of Computing and Digital Systems, vol. 9, no. 2, pp. 159–165, Mar. 2020, doi: 10.12785/IJCDS/090202.
S. A. Raza, M. Shaikh, and K. Tahira, “Cryptocurrency Investigations in Digital Forensics: Contemporary Challenges and Methodological Advances,” Information Dynamics and Applications, vol. 2, no. 3, pp. 126–134, Sep. 2023, doi: 10.56578/ida020302.
M. Z. Mas’ud et al., “A Review of Digital Forensics Framework for Blockchain in Cryptocurrency Technology,” in 2021 3rd International Cyber Resilience Conference, CRC 2021, Institute of Electrical and Electronics Engineers Inc., Jan. 2021. doi: 10.1109/CRC50527.2021.9392563.
S. Salisu, V. Filipov, and B. Pene, “Blockchain Forensics: A Modern Approach to Investigating Cybercrime in the Age of Decentralisation,” in Proceedings of the 18th International Conference on Cyber Warfare and Security, Towson: Towson University, 2023, pp. 338–347. Accessed: Feb. 01, 2025. [Online]. Available: https://papers.academic-conferences.org/index.php/iccws/issue/view/16/18
Y. Wu et al., “A Bitcoin Transaction Network Analytic Method for Future Blockchain Forensic Investigation,” IEEE Trans Netw Sci Eng, vol. 8, no. 2, pp. 1230–1241, Apr. 2021, doi: 10.1109/TNSE.2020.2970113.
S. Meiklejohn et al., “A fistful of bitcoins: Characterizing payments among men with no names,” in Proceedings of the ACM SIGCOMM Internet Measurement Conference, IMC, 2013, pp. 127–139. doi: 10.1145/2504730.2504747.
P. Zheng, Z. Zheng, J. Wu, and H. N. Dai, “On-chain and Off-chain Blockchain Data Collection,” in Blockchain Intelligence: Methods, Applications and Challenges, Springer Singapore, 2021, pp. 15–39. doi: 10.1007/978-981-16-0127-9_2.
A. hyun Park, H. Ryu, W. Park, and D. Jeong, “Forensic investigation framework for cryptocurrency wallet in the end device,” Comput Secur, vol. 133, Oct. 2023, doi: 10.1016/j.cose.2023.103392.
A. Holmes and W. J. Buchanan, “A framework for live host-based Bitcoin wallet forensics and triage,” Forensic Science International: Digital Investigation, vol. 44, Mar. 2023, doi: 10.1016/j.fsidi.2022.301486.
S. Taylor, S. H. yong Kim, K. A. Zainol Ariffin, and S. N. H. Sheikh Abdullah, “A comprehensive forensic preservation methodology for crypto wallets,” Forensic Science International: Digital Investigation, vol. 42–43, Oct. 2022, doi: 10.1016/j.fsidi.2022.301477.
W. Koerhuis, T. Kechadi, and N. A. Le-Khac, “Forensic analysis of privacy-oriented cryptocurrencies,” Forensic Science International: Digital Investigation, vol. 33, Jun. 2020, doi: 10.1016/j.fsidi.2019.200891.
L. Infante, R. A. Hallman, J. Hays, E. Cronnon, and U. Stav, “Recovery CAT: A Digital Forensics Tool for Cryptocurrency Investigations,” in 12th International Symposium on Digital Forensics and Security, ISDFS 2024, Institute of Electrical and Electronics Engineers Inc., 2024. doi: 10.1109/ISDFS60797.2024.10527279.
A. R. Hakim, K. Ramli, T. S. Gunawan, and S. Windarta, “A Novel Digital Forensic Framework for Data Breach Investigation,” IEEE Access, vol. 11, pp. 42644–42659, 2023, doi: 10.1109/ACCESS.2023.3270619.
K. Kent, S. Chevalier, T. Grance, and H. Dang, “Special Publication 800-86 Guide to Integrating Forensic Techniques into Incident Response Recommendations of the National Institute of Standards and Technology.”
S. Kethineni and Y. Cao, “The Rise in Popularity of Cryptocurrency and Associated Criminal Activity,” Int Crim Justice Rev, vol. 30, no. 3, pp. 325–344, 2020, doi: 10.1177/1057567719827051.
M. Alnasaa et al., “Crypto-assets, corruption, and capital controls: Cross-country correlations,” Econ Lett, vol. 215, p. 110492, Jun. 2022, doi: 10.1016/J.ECONLET.2022.110492.
A. Ibrahimi and B. Arifi, “Corruption and Cryptocurrency - Blockchains as corruption tools,” Academicus International Scientific Journal, vol. 26, pp. 93–103, Jul. 2022, doi: 10.7336/ACADEMICUS.2022.26.06.
N. Hiramoto and Y. Tsuchiya, “Measuring dark web marketplaces via Bitcoin transactions: From birth to independence,” Forensic Science International: Digital Investigation, vol. 35, p. 301086, 2020, doi: https://doi.org/10.1016/j.fsidi.2020.301086.
M. Paquet-Clouston, B. Haslhofer, and B. Dupont, “Ransomware payments in the Bitcoin ecosystem,” J Cybersecur, vol. 5, no. 1, Jan. 2019, doi: 10.1093/cybsec/tyz003.
Downloads
Published
How to Cite
Issue
Section
License
Copyright (c) 2025 International Journal of Electrical, Computer, and Biomedical Engineering
This work is licensed under a Creative Commons Attribution 4.0 International License.
