Work in TITANIUM concentrated on the development of tools that fulfill the LEA requirements as well as the legal and ethical guidelines defined during the first project year. The resulting Toolset consists of six tools: the Ephemeral Monitor, the Deception Director, the Wallet Investigator, the Blockchain Investigator, Cointel and GraphSense.
The Ephemeral Monitor provides a presentation of micro-economic aspects of dark web marketplaces, including geographic distribution of advertisements, quantities and other commercial aspects of dark web marketplaces. The Deception Director supports investigations by building scenarios to obtain extra information about a suspect and help with its de-anonymization. The Wallet Investigator is a command-line tool that can secure evidence about cryptocurrency wallets from captured filesystem-based artifacts such as databases and configuration files.
The remaining tools are all cryptocurrency forensics tools that focus on different user groups and use cases. The Blockchain Investigator is a desktop application that focuses on the transaction view of cryptocurrencies, allowing offline analysis and graphically displaying transactions over time. Cointel is web application targeting users that are new to cryptocurrency investigations. GraphSense is an open source platform that provides a web-based search interface that currently supports Bitcoin, Bitcoin Cash, Litecoin, and Zcash. GraphSense is also based on an architecture tailored for researchers that enables customized large-scale analysis of entire blockchain ledgers. In contrast to the Blockchain Investigator, both Cointel and GraphSense focus on the view of addresses and entities and the monetary flows between them, rather than on individual transactions.
The Toolset in turn relied on numerous other project results; for example, the Ephemeral Monitor relies on adaptive scrapers and crawlers that gather data from darknet marketplaces. Various tools made use of new algorithms for de-anonymizing Zcash transactions and data extracted from cross-ledger mixing services. The Kriptosare service provided a means of categorizing virtual currency address clusters based on machine learning models. The Toolset was evaluated and validated in an operational environment through two sets of Field Labs, in which over one hundred law enforcement investigators have participated.
The project results are not limited to software tools. In addition to more than twenty scientific publications, the project has also produced important reports on the characteristics and developments of IOCT and a legal and ethical analysis of darknet/cryptocurrency investigations in general and the TITANIUM Toolset specifically.
