| Bitcoin is a cryptographic digital currency that claims to be an anonymous payment source, which functions the same as cash. In order to participate in the exchange of bitcoins, an individual must connect to the Bitcoin network utilizing one of the many available Bitcoin clients, which are available at no cost to the end-user. The Bitcoin clients, or wallets, can exist as downloadable software or hosted by a third party company online, and are available across various platforms. The Bitcoin currency combined with the birth of black market websites that sell drugs and illegal services creates a platform for criminals to engage in transactions in exchange for illegal goods and services. Because of this, it is important for forensic examiners to be familiar with the evidence that is recoverable from a machine regarding use of the Bitcoin currency. Through obtaining bitcoins and submitting a number of Bitcoin transactions using both a web-hosted and software Bitcoin wallet, this research will identify the Bitcoin evidence that is recoverable through capturing and analyzing the physical memory and hard drive of a Windows machine. This research will highlight the method in which the memory and hard drive of the machine was captured and analyzed, as well as distinguish between the types of Bitcoin artifacts that are able to be recovered from use of the different Bitcoin wallets. This research highlights the relevance for studying the Bitcoin currency and the artifacts that are recoverable through memory analysis, providing an overview for investigations involving use of the Bitcoin currency. This research also identifies the need for additional research into Bitcoin artifacts recoverable from machines running operating systems other than Windows, and Bitcoin run on mobile devices. |
