Controlled experiments in digital evidence tampering

We report on a sequence of experiments performed with graduate level students on the tampering of digital evidence. The task of the study participants was to manipulate a given disk image so that it looked as if a website had been accessed and images downloaded in the past. Later, the same students had to distinguish their forgeries from a set of originals in which the images actually had been downloaded. During all parts of the experiment, efforts were recorded in project diaries. Overall, the results show that the tampering task was difficult since none of the forgeries was taken as an original. Furthermore, the analysis effort to detect forgeries consistently was below the effort to create the forgery even in the worst case scenario where the manipulator had full control over the evidence. It also required generally less effort to correctly classify an original than to correctly classify a forgery. Additionally, we derived results confirming that the effort to construct consistently manipulated evidence increases with decreasing control, i.e., the ability to precisely act upon the evidence.