Traditional industries rapidly transcend the time and place restrictions of the country according to the technology growth by leaps and bounds over the year. Regrettably, international cybercrime incidents simultaneously explode by 2,400 million from 2020 to 2021. Undoubtedly, the real-time incident response has become the primary subject of incident handling. In this article, we aim to propose lawful remote forensics mechanism for ensuring the optimal protection of potential evidence in stochastic and unpredictable transnational crime. Meanwhile, the entire process can be performed remotely and compliant with legal requirements, such as ISO/IEC and NIST regulations. Specifically, all the procedures can be retroactive based on the design of the chain of custody, which leads to the proof of evidence admissibility. Aside from the security essential confirmation by the formal tools Proverif, AVISPA, and Scyther, simulation results have demonstrated that remote forensics can fulfill the legal requirements and perform excellently in various incident scales.

中文翻译：

---

随机且不可预测的跨国犯罪中具有证据采信性的合法远程取证机制


传统产业凭借一年来技术的突飞猛进，迅速超越了国家的时间和地点的限制。令人遗憾的是，2020年至2021年，国际网络犯罪事件同时爆发24亿起。毫无疑问，实时事件响应已成为事件处理的首要课题。在本文中，我们旨在提出合法的远程取证机制，以确保在随机和不可预测的跨国犯罪中对潜在证据进行最佳保护。同时，整个过程可以远程执行，并且符合ISO/IEC和NIST法规等法律要求。具体来说，基于监管链的设计，所有程序都可以追溯，从而导致证据的可采性。除了通过正式工具Proverif、AVISPA和Scyther进行安全必要确认外，模拟结果也表明远程取证可以满足法律要求，并在各种事件规模中表现出色。