A Framework of Darknet Forensics

The dark web market is full of illegal and criminal activities such as the sale of sensitive personal information, guns, drugs, and terrorist videos. Cybercriminals use The Onion Router(TOR) browser to enter the dark web for information publishing and trading. Because the onion router browser provides privacy protection and anonymity, it is widely used. This privacy protection mode has brought great challenges to network investigators. This article aims to detect the use of the latest Tor browser, compare and analyze the evidence information contained in the registry, memory images, hard disk files, and network data packets through forensic experiments. At the same time, it compares and analyzes the different access modes of the Tor browser, and collects and uses Tor browsing. Evidence of cybercrime committed by a device is helpful to the development of electronic data forensics analysis.