A Framework for Rapid Acquisition and Secure Transfer of Disk-Based Digital Evidence During the Golden Hour

Abstract

The "Golden Hour" following a crime incident is critical for the acquisition and preservation of digital evidence to ensure successful forensic investigations. This study presents a practical methodology combining a custom-built remote acquisition script, automated cryptographic hashing for integrity verification, and secure cloud storage to enable timely and tamper-resistant collection and transfer of digital evidence from the crime scene. Unlike traditional approaches that rely on physical transportation of devices to forensic laboratories, the proposed framework supports on-scene forensic imaging with controlled remote transfer, reducing delays and associated risks. Experimental evaluation using an 8 GB USB storage device demonstrates that imaging, hashing, and secure transfer can be completed within approximately 2-3 hours, with integrity confirmed through matching hash values before and after transfer. The results indicate that the methodology improves the efficiency and reliability of disk-based digital evidence handling during the Golden Hour while remaining consistent with established forensic principles.