DIGITAL EVIDENCE ACQUISITION FOLLOWING MINING AND NETWORK ATTACKS IN A PRIVATE BLOCKCHAIN

The rapid adoption of blockchain technology has introduced new cybersecurity challenges, particularly in private blockchain environments where mining and network attacks pose significant threats. This study investigates the digital forensics process within private blockchain environments, with a specific focus on methodologies for acquiring digital evidence following mining and network attacks. In this context, we propose two complementary evidence acquisition models applied to Hyperledger Fabric: a post-mortem model using forensic disk imaging and hash verification (dd, sha256sum), and a live acquisition model using Hyperledger Explorers REST API. Attack simulations including Denial-of-Service (DoS), 51%, and selfish mining attacks were conducted to validate the proposed models. The proposed models successfully enabled the identification and collection of user-generated and machine-generated evidence, including cryptographic transactions, node event logs, smart contract interactions, and network traffic metadata, while preserving chain of custody integrity. This work contributes a structured, practical methodology for blockchain forensics in private environments, addressing the unique challenges posed by the decentralized and immutable nature of blockchain systems.