Blockchain-Integrated Lightweight Cryptographic Framework for Detecting File Timestamp Manipulation in Digital Forensic Analysis

DOI

No DOI

Published In

Volume 5, Issue 1 (2026)

Published Online

January-April 2026

Pages

387-391

Article Type

Original Article

Check for updates

No DOI available for cross-reference

File timestamp manipulation is a prevalent anti-forensic technique in which attackers deliberately alter file creation, modification, or access times to obscure evidence and mislead digital investigators. Conventional detection methods, such as manual timeline analysis, checksum comparison, and log correlation, are frequently insufficient against sophisticated tampering and scale poorly to large datasets. This paper presents TimeMiner, a blockchain-integrated cryptographic framework that combines post-quantum secure Leighton-Micali Signatures (LMS) with decentralized blockchain storage to detect unauthorized timestamp modifications in real time. The proposed system extracts file metadata, generates cryptographic hashes for both file content and timestamps, and signs them using the LMS algorithm supported by Merkle tree authentication paths. These signatures are recorded on an immutable blockchain ledger, ensuring traceability and tamper-proof storage. During forensic verification, any mismatch between the stored LMS signature and the recomputed metadata hash triggers an immediate alert. The system is implemented using Python 3.8, Flask, MySQL, and WampServer, and validated across unit, integration, system, performance, and security test phases. Experimental results confirm high tamper detection accuracy, efficient processing of large file batches, and reliable blockchain immutability. The framework provides a scalable, quantum-resistant solution that significantly strengthens the integrity, transparency, and legal admissibility of digital forensic evidence.