Live Network Acquisition with Pre-Serialization Hashing for Digital Evidence Integrity

Abstract

The integrity of digital evidence remains a fundamental requirement in network forensic investigations, particularly during the live acquisition phase where packet captures are vulnerable to anti-forensic manipulation. Conventional forensic workflows generally perform cryptographic verification after packet data has been serialized into secondary storage, creating a temporary exposure window that may allow unauthorized modification before integrity validation occurs. This study proposes a proactive forensic acquisition framework that performs cryptographic hashing directly in volatile memory prior to storage serialization. The proposed architecture utilizes Python’s io.BytesIO() mechanism to temporarily preserve packet streams in RAM and generate SHA-256 signatures before physical .pcap file creation. To evaluate the robustness of the framework, ten PCAP datasets consisting of attack and normal traffic captures were processed using an in-memory hashing pipeline. A controlled single-bit tampering simulation was subsequently applied to each serialized file to measure cryptographic sensitivity through Hamming Distance and Avalanche Effect analysis. Experimental results demonstrate that all manipulated files produced complete cryptographic divergence from their original in-memory signatures. The average Hamming Distance reached 132.2 bits with a mean avalanche probability of 0.5164, closely matching the theoretical characteristics of secure hash functions. These findings indicate that pre-serialization integrity verification significantly improves the reliability of digital evidence preservation by reducing the vulnerability window associated with conventional post-acquisition hashing mechanisms.