Desarrollo de una herramienta forense bajo la normativa NIST 2001 para la recolección, validación y certificación de evidencia electrónica digital online en la red social Twitter

Abstract

The objective of the proposed work is to create a forensic system based on NIST 2001 regulations for the collection of digital electronic evidence from the social network Twitter, including the certification of this evidence by means of digital signature and time stamping; thus avoiding the adulteration of the evidence during the prosecution of criminal acts. Considering that the data published in a social network will only exist at one point in time, working on a copy of this data should consider the best practice of having extracted as much information as possible. Through the stages defined for the model that includes two environments, one physical and the digital, various tasks are proposed to be executed in each of these environments, and in turn as a result of the proposal directed towards the digital environment attached to Ecuadorian regulations regarding issues such as documentary evidence, digital signature and time stamping, a python script proposal is developed with different tools such as Tweepy, OSRFramework, Santoku, and other libraries of the language, to collect evidence on the network social, through a simplistic and understandable programming code that seeks to interpret the data and that each element can be verifiable, making the process as easy to follow as possible.