A Review Paper on Dark Web Forensics: Investigating Cybercrimes in the Hidden Internet

Career Point International Journal of Research (CPIJR) ©2022 CPIJR ǀ Volume 3 ǀ Issue 4 ǀ ISSN: 2583-1895 July-September 2025 | DOI: https://doi.org/10.5281/zenodo.17336369 58 A Review Paper on Dark Web Forensics: Investigating Cybercrimes in the Hidden Internet Dipesh Kumar Sen1, Ms. Tanvi Thakur2 1Student(BCA) School of Computer Application & Technology, Career Point University, Kota (Raj.), India 2Assistant Professor, School of Computer Application & Technology, Career Point University, Kota (Raj.), India Abstract The dark web, a concealed segment of the internet accessible only through specialized software(browser) like Tor, has evolved into a digital ecosystem that facilitates both legitimate privacy-centric use and widespread criminal enterprise. This review explores the forensic investigation challenges and methodologies associated with cybercrimes on the dark web. By synthesizing insights from recent studies, it examines the architecture and dynamics of the dark web, the typologies of illicit activities it harbors—including trafficking in narcotics, weapons, and stolen data—and the role of cryptocurrencies in facilitating anonymous transactions. Moreover, it emphasizes emerging forensic strategies leveraging artificial intelligence (AI) and machine learning (ML) to enhance detection, classification, and disruption of dark web criminal activities. The paper highlights the multidisciplinary convergence of cybersecurity, digital forensics, and data science needed to combat the evolving threats in this hidden layer of the internet. Keywords: Data Visualization, Business Intelligence, Analytics, Reporting, Interactive Dashboards, Information Technology Introduction In recent years, the dark web has emerged as both a heaven for privacy advocates and a hotbed of criminal activities. Operating beneath the surface of the visible internet, this encrypted domain supports a range of hidden services that are inaccessible to traditional search engines and requires specialized tools like the Tor browser for access. While its anonymity provides refuge for journalists, whistle-blowers, and political dissidents, it also Career Point International Journal of Research (CPIJR) ©2022 CPIJR ǀ Volume 3 ǀ Issue 4 ǀ ISSN: 2583-1895 July-September 2025 | DOI: https://doi.org/10.5281/zenodo.17336369 59 enables the proliferation of illegal markets, child exploitation material, illicit drug trade, weapons trafficking, and extremist communications. The unique technological framework of the dark web—such as onion routing and cryptocurrency-based transactions—presents significant challenges for law enforcement and forensic investigators. The decentralized and anonymized nature of these networks complicates traditional investigative techniques. As a result, there is a growing need for advanced analytical tools and forensic methodologies to identify, monitor, and mitigate these threats. Recent academic work highlights the increasing sophistication of criminal activities on the dark web and calls for an equally advanced forensic response. For example, AI and MLbased tools are now being developed to automatically detect illicit content, trace cryptocurrency flows, and uncover hidden patterns within large volumes of unstructured dark web data. These innovations represent a paradigm shift in cybercrime investigation, enabling law enforcement to proactively address complex digital threats. The dark web has rapidly evolved from a niche layer of the internet into a complex digital underground that facilitates a wide array of transnational cybercrimes. With its promise of anonymity and encrypted access, it has become an ideal environment for criminal operations involving drug trafficking, weapons sales, child exploitation, terrorism, identity theft, and illegal financial transactions using crypto currencies such as Bit coin and Moreno. The dark web’s expanding influence presents a significant threat to global cyber security, law enforcement, and digital governance. Despite numerous enforcement actions, including the high-profile takedown of Silk Road and Playpen, dark web marketplaces continue to proliferate. They operate resiliently, often using decentralized platforms, anonymization tools, and encrypted communications that make detection and prosecution of criminal actors exceedingly difficult. This underscores the need for specialized forensic methodologies capable of navigating the technological and legal complexities of dark web investigations. Scope: 1. Understanding the Dark Web Ecosystem  Distinction between the Surface Web, Deep Web, and Dark Web Career Point International Journal of Research (CPIJR) ©2022 CPIJR ǀ Volume 3 ǀ Issue 4 ǀ ISSN: 2583-1895 July-September 2025 | DOI: https://doi.org/10.5281/zenodo.17336369 60  Overview of anonymizing technologies (e.g., Tor, I2P, Freenet)  Hidden services and .onion domains  Dark web access mechanisms and user behavior patterns 2. Typologies of Cybercrimes in the Dark Web  Illicit trade in narcotics, firearms, counterfeit goods, and stolen data  Child exploitation and violent content distribution  Cybercrime-as-a-service: malware kits, DDoS-for-hire, ransomware distribution  Use of the dark web by terrorist groups for communication, recruitment, and funding 3. Challenges in Dark Web Forensics  Technical barriers: anonymization, encryption, volatility of dark web services  Legal and jurisdictional challenges in cross-border investigations  Difficulty in evidence collection, preservation, and chain-of-custody management  Ethical considerations and privacy implications in forensic practices 4. Forensic Techniques and Approaches  Crawling and scraping hidden services  Link analysis and pattern recognition  Metadata extraction and behavioral analysis  Cryptocurrency and blockchain forensics (e.g., tracing Bitcoin and Monero transactions) 5. Role of Artificial Intelligence and Machine Learning  AI for automated content classification and anomaly detection  ML algorithms for identifying criminal patterns and clustering illicit services  Use of natural language processing (NLP) in analyzing dark web forums and marketplaces  Case studies utilizing AI-powered forensic platforms Review of Literature 1. Emerging Trends and AI in Dark Web Forensics Career Point International Journal of Research (CPIJR) ©2022 CPIJR ǀ Volume 3 ǀ Issue 4 ǀ ISSN: 2583-1895 July-September 2025 | DOI: https://doi.org/10.5281/zenodo.17336369 61 Singh et al. (2022) leveraged deep learning models to profile vendors and analyse transaction data on dark web marketplaces. Their approach focuses on uncovering hidden patterns linked to criminal activities. AI enables automation in detecting anomalies and suspicious behaviour at scale. This represents a shift from reactive to predictive dark web investigation methods. 2. Nature and Structure of the Dark Web Moore & Rid (2021) explored the architecture of the Tor network, a key enabler of the dark web. They emphasized how Tor provides layered encryption and anonymous communication. The proliferation of hidden services (.onion domains) has allowed criminal enterprises to flourish. Their work underpins the need to understand infrastructure before launching forensic efforts. 3. Digital Forensic Methodologies Casey et al. (2020) adapted conventional digital forensic practices for dark web environments. They applied methods like memory analysis and disk imaging in anonymous networks. Tailored network forensics was introduced to address encrypted and decentralized platforms. Their research bridged traditional forensics with the complexities of anonymized cybercrime. 4 .Dark Web Crawling and Data Collection Yang et al. (2019) developed a machine learning-powered focused crawler for dark web sites. It predicts and follows .onion links, enhancing data collection efficiency across volatile services. Their crawler targets relevant content while bypassing misleading or decoy pages. This approach significantly improves the scope and depth of dark web intelligence gathering. 5.Legal and Ethical Considerations Goodman and Brenner (2018) highlighted cross-border legal complexities in dark web investigations. Jurisdictional conflicts often arise when evidence spans multiple countries and legal systems. Issues of privacy, surveillance rights, and data admissibility are central to ethical debates. Their study stresses the importance of international cooperation and clear legal frameworks. Career Point International Journal of Research (CPIJR) ©2022 CPIJR ǀ Volume 3 ǀ Issue 4 ǀ ISSN: 2583-1895 July-September 2025 | DOI: https://doi.org/10.5281/zenodo.17336369 62 6. Forensic Challenges Owen & Savage (2015) documented technical obstacles in dark web evidence acquisition. Anonymity tools, encryption, and rapid content turnover complicate user tracking. Traditional digital forensics often fails to cope with the dark web’s dynamic and evasive nature. Their findings underscore the need for more robust, adaptive forensic technologies. 7. Cryptocurrency Forensics in the Dark Web El-Kady (2025) emphasizes the challenges of tracing cryptocurrency transactions on the dark web. His study highlights the importance of analysing blockchain data, especially with privacy coins like Monero and Verge. Clustering algorithms and graph-based analysis are used to de-anonymize financial flows. The research underlines the critical role of AI in tracking illicit funds across decentralized platforms. 8. Content Classification of Hidden Services Al Nabki et al. (2017) conducted a large-scale study classifying over 7,000 .onion sites into 26 categories. They used manual tagging and machine learning to differentiate between legal and illegal services. Illicit content, such as drugs, counterfeits, and stolen data, made up a significant portion. Their findings support the need for intelligent filtering tools in dark web surveillance. 9. Dark Web as a Terrorist Enabler Weimann (2016) explored how terrorist organizations exploit the dark web for communication and recruitment. Groups like ISIS have migrated to hidden services after surface web crackdowns. The dark web offers resilient platforms for propaganda, training, and anonymous funding. This highlights a national security dimension in forensic monitoring of extremist content. 10. Market Dynamics and Trust on Darknet Platforms Tzanetakis (2018) analyzed user behavior and trust mechanisms in darknet drug markets. Vendors rely on pseudonymous reputations, escrow services, and customer reviews to build Career Point International Journal of Research (CPIJR) ©2022 CPIJR ǀ Volume 3 ǀ Issue 4 ǀ ISSN: 2583-1895 July-September 2025 | DOI: https://doi.org/10.5281/zenodo.17336369 63 credibility. Cryptomarkets function similarly to e-commerce platforms but operate outside the law. These dynamics complicate forensic efforts, as markets frequently rebrand or migrate. Research Gaps  Despite the extreme things which have been happening through the dark web, there is still much to be explored about this topic.  Limited Real-Time Monitoring: Most existing tools can’t capture or analyze Dark Web data instantly, causing delays in detecting threats or illegal activities. Real-time insights are crucial for timely responses but remain a challenge. This limits the effectiveness of investigations. Improving this could enhance threat prevention.  Tool Standardization: There’s no common set of tools or procedures for Dark Web forensics, so different teams use varied methods. This inconsistency leads to unreliable or non-comparable results. Standardizing tools would ensure better accuracy and collaboration. It would also speed up investigations.  Lack of Legal Frameworks: International laws are unclear or missing regarding how to handle Dark Web evidence and user privacy. This creates legal risks for investigators, especially across countries. Without clear rules, evidence might be inadmissible in court. Stronger frameworks are needed to protect rights and aid prosecution.  Ethical Dilemmas in Investigative Practices: Using proactive techniques like surveillance or honey-pots raises ethical questions about privacy and fairness. Few studies have thoroughly examined these issues on the Dark Web. Investigators risk crossing moral boundaries unintentionally. Clear ethical guidelines would help balance safety and rights.  Jurisdictional and Legal Complexity: Cyber laws vary widely between countries, making Dark Web investigations legally complex. There’s little research on how to harmonize these laws internationally. This patchwork can stall or block cross-border cooperation. A unified approach would streamline investigations and legal processes. Objective of Research The primary objective of this review paper is to investigate the cybercrime nowadays for e.g. black marketing of weapons and illegal videos. This research is to verify that the modern tools are competent or not. Some other objective of this review are: Career Point International Journal of Research (CPIJR) ©2022 CPIJR ǀ Volume 3 ǀ Issue 4 ǀ ISSN: 2583-1895 July-September 2025 | DOI: https://doi.org/10.5281/zenodo.17336369 64  To analyze the multifaceted roles of the Dark Web in facilitating criminal activities, including its function as a marketplace, communication platform, and enabler of cybercrime, while assessing the implications for global security.  To collect and categorize data from over 25,000 hidden services on the Dark Web, identifying the nature of content available, with a focus on illegal activities and the prevalence of non-English content, particularly in Russian.  To explore the integration of artificial intelligence and machine learning in digital forensics, specifically targeting the identification and analysis of illicit activities on the Dark Web, including cryptocurrency transactions.  To investigate the contrasting uses of the Dark Web, highlighting its potential for both legitimate expression and criminal exploitation, thereby providing a nuanced understanding of its impact on society and law enforcement.  To assess the current methodologies employed by law enforcement agencies in combating Dark Web crimes, identifying gaps and proposing enhancements through technological advancements, particularly in AI and machine learning.  To analyze the historical development and transformation of Dark Web markets, including the emergence of new platforms and the decline of others, to understand trends in illicit trade and user behavior over time.  To examine the significance of cryptocurrencies in facilitating anonymous transactions on the Dark Web, assessing their impact on the proliferation of illegal goods and services, and exploring potential regulatory responses. Research Methodology Literature Review: This involves a thorough examination of academic journals, case studies, and technical reports related to Dark Web forensics. The goal is to synthesize existing knowledge, identify key findings, and understand the current state of research in this field. Comparative Analysis: This entails evaluating the various tools, methods, and technologies currently employed in Dark Web investigations. By comparing their effectiveness, strengths, and weaknesses, this analysis aims to identify best practices and areas for improvement in forensic investigations. Career Point International Journal of Research (CPIJR) ©2022 CPIJR ǀ Volume 3 ǀ Issue 4 ǀ ISSN: 2583-1895 July-September 2025 | DOI: https://doi.org/10.5281/zenodo.17336369 65 Case Study Approach: This method focuses on analyzing specific real-world Dark Web investigations, such as those involving Silk Road and AlphaBay. By highlighting the forensic techniques used in these cases, the approach provides practical insights into the challenges and successes of Dark Web forensics. Gap Identification: A systematic review is conducted to pinpoint research gaps and areas that require further exploration in Dark Web forensics. This process aims to inform future research directions and enhance the overall understanding of forensic practices in this complex digital landscape. Overview of Dark Web The Dark Web is a hidden segment of the internet that operates on encrypted networks, primarily accessed through specialized software like the Tor browser. It is characterized by its anonymity, allowing users to engage in activities without revealing their identities. While the Dark Web serves as a platform for free expression and communication, it is also notorious for facilitating a wide range of illicit activities, including drug trafficking, weapons sales, and the distribution of child pornography. Recent research highlights the dual nature of the Dark Web, where it acts as both a haven for legitimate users seeking privacy and a marketplace for criminals. The Dark Web's structure supports various illegal operations, with a significant portion of its content being classified as unethical or illegal. Studies have shown that a substantial percentage of hidden services on the Dark Web are involved in criminal activities, with many sites offering services related to drugs, counterfeit goods, and hacking tools. Career Point International Journal of Research (CPIJR) ©2022 CPIJR ǀ Volume 3 ǀ Issue 4 ǀ ISSN: 2583-1895 July-September 2025 | DOI: https://doi.org/10.5281/zenodo.17336369 66 Figure: 1 Various parts of the web, including the dark web Advantages and Disadvantages Advantages of the Dark Web  Anonymity and Privacy: The Dark Web provides users with a high level of anonymity, allowing individuals to communicate and share information without fear of surveillance or censorship. This is particularly beneficial for whistleblowers, activists, and journalists operating in oppressive regimes.  Access to Uncensored Information: Users can access information that may be restricted or censored in their countries, including political dissent, human rights issues, and sensitive topics that are not covered in mainstream media.  Support for Free Speech: The Dark Web serves as a platform for free expression, enabling individuals to discuss controversial or sensitive subjects without the risk of persecution.  Cryptocurrency Transactions: The use of cryptocurrencies on the Dark Web allows for anonymous financial transactions, which can be advantageous for users seeking to maintain their privacy in financial dealings.  Innovation in Security Technologies: The challenges posed by the Dark Web have led to advancements in cybersecurity and digital forensics, as researchers and law enforcement develop new tools and techniques to combat illicit activities. Disadvantages of the Dark Web  Facilitation of Illegal Activities: The Dark Web is notorious for hosting a wide range of illegal activities, including drug trafficking, weapons sales, human trafficking, and the distribution of child pornography. This creates significant challenges for law enforcement.  Scams and Fraud: Many users fall victim to scams on the Dark Web, as the anonymity of transactions makes it difficult to hold malicious actors accountable. Users may encounter fraudulent services or products that do not deliver as promised.  Exposure to Harmful Content: The Dark Web contains a vast amount of disturbing and illegal content, which can be psychologically harmful to users who inadvertently access it.