A Secure Digital Forensic Framework for Text Evidence Authentication and Integrity Validation

Digital forensics has become a fundamental component of cybercrime investigations, where digital text evidence, including emails, chat records, documents, and system logs, plays a crucial role in identifying and prosecuting malicious activities. Preserving the authenticity and integrity of such evidence is essential, as even slight modifications can compromise forensic analysis and affect legal admissibility. Although conventional security mechanisms primarily emphasize data encryption to maintain confidentiality, they often lack robust methods for verifying data integrity before the decryption process. The growing incidence of cyber-attacks, digital tampering, and online fraud has created a demand for forensic frameworks capable of both protecting and authenticating digital evidence. In the absence of effective integrity verification, encrypted data may still be altered, resulting in unreliable forensic outcomes and reduced evidential value. To overcome these limitations, the proposed Twin Route Forensics framework integrates user authentication, secure encryption, and hash-based integrity verification into a unified system. The framework ensures that digital text evidence is decrypted and restored only after successful validation of its authenticity, thereby preventing unauthorized modifications and preserving data reliability. By combining confidentiality with pre-decryption integrity checking, the proposed approach enhances the security, trustworthiness, and evidential value of digital text data. The system provides a robust solution for modern digital forensic investigations and contributes to the development of more secure and dependable cybercrime investigation processes.