by Markus Haudum
When trying to store the visible state of a website there are a few possibilities available, starting from the usage of archives to the creation and printing of screenshots. All those methods and systems suffer from the same problem. They can't guarantee that the stored information is current because they don't provide any information about caching and it is unclear if the data came from proxies between the client and the server or from the original server. This information is very important in a law court, because it must be ensured that the collected data was current and not outdated. The way used to gather that information is also very important regarding the immutability of the collected data. This master thesis describes the development of software to overcome the problems of existing technologies and provides a complete system for storing websites in a way that the collected data is of forensic value. A java application called Webstamp was developed which allows the user to store specific websites. All the forensic aspects of immutable and most up to date data are taken over by the software automatically, which is ensured by hash-values and timestamp services. At the end of this thesis an evaluation about the software is made based on a few selected websites. The collected information from this evaluation is then used to discuss improvements of the developed software.

Download