Forensic investigation framework for cryptocurrency wallet in the end device

Cryptocurrency is increasingly being utilized in criminal activities such as money laundering and the acquisition of illicit goods from darknet markets, due in part to its pseudonymous and decentralized nature. Despite this, there is currently no widely accepted digital forensic framework to assist in the investigation of cryptocurrency-related crimes. To address this gap, we propose a three-phase framework for the forensic examination of cryptocurrency wallets. This framework consists of three distinct stages: Forensic Readiness, Acquisition, and Investigation. The aim of this study is to offer investigators a standardized methodology for conducting cryptocurrency investigations. To assess the validity of our proposed framework, we conducted experiments using three well-known cryptocurrency wallets. The results of these experiments indicate that the proposed framework holds significant potential as a general framework for cryptocurrency forensics.