Cyber Evidence Locker

Digital evidence — CCTV footage, PDFs, images, logs, reports — can be modified without leaving visible traces. In cyber forensics and security investigations, even a one-byte modification can compromise the authenticity and legal reliability of evidence. Traditional file storage systems focus on storing data but do not provide strong mechanisms to prove whether evidence has remained unchanged. If someone tampers with a stored file, replaces records, or modifies historical evidence, it becomes difficult to detect exactly when and where the compromise happened. Existing classroom-level integrity systems stop at simple hashing — insufficient for demonstrating real-world forensic security workflows.

Modern forensic systems do not rely only on storing files — they rely on creating a cryptographic chain of trust. Instead of treating each evidence file independently, the project connects evidence records using blockchain-inspired linking, cryptographic hashing, Merkle tree verification, and digital signatures. If even a single file is modified, the integrity of the entire chain is affected and tampering becomes immediately visible. The project transforms abstract cryptographic concepts into an interactive forensic system where users can observe hash changes, avalanche effects, chain break propagation, and signature verification failure — in real time.

A decoupled architecture where the frontend handles file ingestion and chunking, while the backend API manages the secure hashing pipeline, immutable ledger updates, signature verification, and Merkle root generation.

Whirlpool (512-bit) chosen over SHA-256 for its wider internal state, making it harder to reverse — critical for forensic evidence. Blockchain-inspired linking used over a flat hash database because chain integrity makes tampering immediately visible across all downstream blocks. Merkle trees enable partial proof verification without re-hashing the entire dataset. The attack simulation engine was designed deliberately as a first-class feature rather than an afterthought — you cannot teach trust without demonstrating its violation.

Cryptography is not only about encryption — it is about establishing trust, authenticity, integrity, and traceability in digital systems. Key learnings: practical implementation of cryptographic hash functions, how blockchain structures ensure immutability, real-world use of Merkle Trees and digital signatures, visualization of the avalanche effect, and designing secure forensic workflows. The project resulted in a fully interactive forensic platform with evidence upload, dashboard, tamper detection, chain verification, and attack simulation.

Cloud-based distributed evidence storage, multi-user investigator roles, real RSA/ECC-based signatures, AI-assisted anomaly detection, real-time folder monitoring, exportable forensic reports, and integration with decentralized storage systems like IPFS. Long-term goal: a practical forensic trust platform for real-world cybersecurity and digital evidence preservation.