Evaluating Tooling and Methodology when Analysing Bitcoin Mixing Services after Forensic Seizure

Edward Henry Young; Christos Chrysoulas; Nikolaos Pitropakis; Pavlos Papadopoulos; William J. Buchanan

doi:10.1109/ICDABI53623.2021.9655843

Evaluating Tooling and Methodology when Analysing Bitcoin Mixing Services after Forensic Seizure

Edward Henry Young, Christos Chrysoulas, Nikolaos Pitropakis, Pavlos Papadopoulos, William J. Buchanan

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

3 Citations (Scopus)

Abstract

Little or no research has been directed to analysis and researching forensic analysis of the Bitcoin mixing or ‘tumbling’ service themselves. This work is intended to examine effective tooling and methodology for recovering forensic artifacts from two privacy focused mixing services namely Obscuro which uses the secure enclave on intel chips to provide enhanced confidentiality and Wasabi wallet which uses CoinJoin to mix and obfuscate crypto currencies. These wallets were set up on VMs and then several forensic tools used to examine these VM images for relevant forensic artifacts. These forensic tools were able to recover a broad range of forensic artifacts and found both network forensics and logging files to be a useful source of artifacts to deanonymize these mixing services.

Original language	English
Title of host publication	2021 International Conference on Data Analytics for Business and Industry
Publisher	IEEE
ISBN (Electronic)	9781665416566
ISBN (Print)	9781665416573
DOIs	https://doi.org/10.1109/ICDABI53623.2021.9655843
Publication status	Published - 29 Dec 2021
Event	International Conference on Data Analytics for Business and Industry 2021 - virtual/online, Sakheer, Bahrain Duration: 25 Oct 2021 → 26 Oct 2021

Conference

Conference	International Conference on Data Analytics for Business and Industry 2021
Abbreviated title	ICDABI 2021
Country/Territory	Bahrain
City	Sakheer
Period	25/10/21 → 26/10/21

Keywords

Bitcoin
Forensic Analysis
Obscuro
Wasabi
Data privacy
Privacy
Forensics
Operating systems
Writing
Silcon

ASJC Scopus subject areas

Business, Management and Accounting (miscellaneous)
Artificial Intelligence
Computer Networks and Communications
Information Systems
Information Systems and Management
Safety, Risk, Reliability and Quality
Health Informatics

Access to Document

10.1109/ICDABI53623.2021.9655843

Cite this

@inproceedings{f057b441b36340c390915176d99e4d42,

title = "Evaluating Tooling and Methodology when Analysing Bitcoin Mixing Services after Forensic Seizure",

abstract = "Little or no research has been directed to analysis and researching forensic analysis of the Bitcoin mixing or {\textquoteleft}tumbling{\textquoteright} service themselves. This work is intended to examine effective tooling and methodology for recovering forensic artifacts from two privacy focused mixing services namely Obscuro which uses the secure enclave on intel chips to provide enhanced confidentiality and Wasabi wallet which uses CoinJoin to mix and obfuscate crypto currencies. These wallets were set up on VMs and then several forensic tools used to examine these VM images for relevant forensic artifacts. These forensic tools were able to recover a broad range of forensic artifacts and found both network forensics and logging files to be a useful source of artifacts to deanonymize these mixing services.",

keywords = "Bitcoin, Forensic Analysis, Obscuro, Wasabi, Data privacy, Privacy, Forensics, Operating systems, Writing, Silcon",

author = "Young, \{Edward Henry\} and Christos Chrysoulas and Nikolaos Pitropakis and Pavlos Papadopoulos and Buchanan, \{William J.\}",

note = "Publisher Copyright: {\textcopyright} 2021 IEEE.; International Conference on Data Analytics for Business and Industry 2021, ICDABI 2021 ; Conference date: 25-10-2021 Through 26-10-2021",

year = "2021",

month = dec,

day = "29",

doi = "10.1109/ICDABI53623.2021.9655843",

language = "English",

isbn = "9781665416573",

booktitle = "2021 International Conference on Data Analytics for Business and Industry",

publisher = "IEEE",

address = "United States",

}

Young, EH, Chrysoulas, C, Pitropakis, N, Papadopoulos, P & Buchanan, WJ 2021, Evaluating Tooling and Methodology when Analysing Bitcoin Mixing Services after Forensic Seizure. in 2021 International Conference on Data Analytics for Business and Industry., 9655843, IEEE, International Conference on Data Analytics for Business and Industry 2021, Sakheer, Bahrain, 25/10/21. https://doi.org/10.1109/ICDABI53623.2021.9655843

TY - GEN

T1 - Evaluating Tooling and Methodology when Analysing Bitcoin Mixing Services after Forensic Seizure

AU - Young, Edward Henry

AU - Chrysoulas, Christos

AU - Pitropakis, Nikolaos

AU - Papadopoulos, Pavlos

AU - Buchanan, William J.

PY - 2021/12/29

Y1 - 2021/12/29

N2 - Little or no research has been directed to analysis and researching forensic analysis of the Bitcoin mixing or ‘tumbling’ service themselves. This work is intended to examine effective tooling and methodology for recovering forensic artifacts from two privacy focused mixing services namely Obscuro which uses the secure enclave on intel chips to provide enhanced confidentiality and Wasabi wallet which uses CoinJoin to mix and obfuscate crypto currencies. These wallets were set up on VMs and then several forensic tools used to examine these VM images for relevant forensic artifacts. These forensic tools were able to recover a broad range of forensic artifacts and found both network forensics and logging files to be a useful source of artifacts to deanonymize these mixing services.

AB - Little or no research has been directed to analysis and researching forensic analysis of the Bitcoin mixing or ‘tumbling’ service themselves. This work is intended to examine effective tooling and methodology for recovering forensic artifacts from two privacy focused mixing services namely Obscuro which uses the secure enclave on intel chips to provide enhanced confidentiality and Wasabi wallet which uses CoinJoin to mix and obfuscate crypto currencies. These wallets were set up on VMs and then several forensic tools used to examine these VM images for relevant forensic artifacts. These forensic tools were able to recover a broad range of forensic artifacts and found both network forensics and logging files to be a useful source of artifacts to deanonymize these mixing services.

KW - Bitcoin

KW - Forensic Analysis

KW - Obscuro

KW - Wasabi

KW - Data privacy

KW - Privacy

KW - Forensics

KW - Operating systems

KW - Writing

KW - Silcon

UR - https://www.scopus.com/pages/publications/85123314510

U2 - 10.1109/ICDABI53623.2021.9655843

DO - 10.1109/ICDABI53623.2021.9655843

M3 - Conference contribution

AN - SCOPUS:85123314510

SN - 9781665416573

BT - 2021 International Conference on Data Analytics for Business and Industry

PB - IEEE

T2 - International Conference on Data Analytics for Business and Industry 2021

Y2 - 25 October 2021 through 26 October 2021

ER -

Evaluating Tooling and Methodology when Analysing Bitcoin Mixing Services after Forensic Seizure

Abstract

Conference

Keywords

ASJC Scopus subject areas

Access to Document

Other files and links

Fingerprint

Cite this