Cloud Computing is arguably one of the most discussed information technologies today. It presents many promising technological and economical opportunities. However, many customers remain reluctant to move their business IT infrastructure completely to the cloud. One of their main concerns is Cloud Security and the threat of the unknown. Cloud Service Providers (CSP) encourage this perception by not letting their customers see what is behind their virtual curtain. A seldomly discussed, but in this regard highly relevant open issue is the ability to perform digital investigations. This continues to fuel insecurity on the sides of both providers and customers. Cloud Forensics constitutes a new and disruptive challenge for investigators. Due to the decentralized nature of data processing in the cloud, traditional approaches to evidence collection and recovery are no longer practical. This paper focuses on the technical aspects of digital forensics in distributed cloud environments. We contribute by assessing whether it is possible for the customer of cloud computing services to perform a traditional digital investigation from a technical point of view. Furthermore we discuss possible solutions and possible new methodologies helping customers to perform such investigations.

Technical Issues of Forensic Investigations in Cloud Computing Environments

Secure data deletion is the task of deleting data irrecoverably from a physical medium. In the digital world, data is not securely deleted by default; instead, many approaches add secure deletion to existing physical medium interfaces. Interfaces to the physical medium exist at different layers, such as user-level applications, the file system, the device driver, etc. Depending on which interface is used, the properties of an approach can differ significantly. In this paper, we survey the related work in detail and organize existing approaches in terms of their interfaces to physical media. We further present a taxonomy of adversaries differing in their capabilities as well as a systematization for the characteristics of secure deletion approaches. Characteristics include environmental assumptions, such as how the interface's use affects the physical medium, as well as behavioural properties of the approach such as the deletion latency and physical wear. We perform experiments to test a selection of approaches on a variety of file systems and analyze the assumptions made in practice.

/pdf/sok-secure-data-deletion-4e0lnalrs3.pdf

SoK: Secure Data Deletion

Blockchain-based publicly verifiable data deletion scheme for cloud storage

http://simson.net/ref/2012/2012-08-07%20Lessons.pdf

Lessons learned writing digital forensics tools and managing a 30TB digital evidence corpus

The recent popularity of research on topics of multimedia forensics justifies reflections on the definition of the field. This paper devises an ontology that structures forensic disciplines by their primary domain of evidence. In this sense, both multimedia forensics and computer forensics belong to the class of digital forensics, but they differ notably in the underlying observer model that defines the forensic investigator's view on (parts of) reality, which itself is not fully cognizable. Important consequences on the reliability of probative facts emerge with regard to available counter-forensic techniques: while perfect concealment of traces is possible for computer forensics, this level of certainty cannot be expected for manipulations of sensor data. We cite concrete examples and refer to established techniques to support our arguments.

/pdf/multimedia-forensics-is-not-computer-forensics-2jwwpf5h2h.pdf

Multimedia Forensics Is Not Computer Forensics

Often we hear controversial opinions in digital forensics on the required or desired number of passes to utilize for properly overwriting, sometimes referred to as wiping or erasing, a modern hard drive. The controversy has caused much misconception, with persons commonly quoting that data can be recovered if it has only been overwritten once or twice. Moreover, referencing that it actually takes up to ten, and even as many as 35 (referred to as the Gutmann scheme because of the 1996 Secure Deletion of Data from Magnetic and Solid-State Memory published paper by Peter Gutmann) passes to securely overwrite the previous data. One of the chief controversies is that if a head positioning system is not exact enough, new data written to a drive may not be written back to the precise location of the original data. We demonstrate that the controversy surrounding this topic is unfounded.

/pdf/overwriting-hard-drive-data-the-great-wiping-controversy-4atsnfwjem.pdf

Overwriting Hard Drive Data: The Great Wiping Controversy

This is the only official, EC-Council-endorsed CHFI (Computer Hacking Forensics Investigator) study guide. It was written for security professionals, systems administrators, IT consultants, legal professionals, IT managers, police and law enforcement personnel studying for the CHFI certification, and professionals needing the skills to identify an intruder's footprints and properly gather the necessary evidence to prosecute. Key features include: .The Only Official Study Guide for CHFI Provides 100% coverage of all exam objectives. .Full Web-based ExamModeled after the real exam, it also includes explanations of correct and incorrect answers..Exam ObjectivesEach is clearly explained at the beginning of the chapter..Notes and AlertsHighlight crucial points of the exam modules..Exam Objectives Fast TrackBulleted highlights emphasize the important points from the exam's perspective at the end of the chapter..Key TermsAll concepts are defined and explained as they appear. .Exam Objectives Frequently Asked QuestionsTest what you have learned by reading FAQs based on the material covered in the chapter. Log on to the Syngress Web site to access review questions based on the exam.

The Official CHFI Study Guide

Publisher Summary
Digital versatile discs (DVDs) are an evolutionary growth of compact disc (CD's) with slight changes. Both CDs and DVDs are electro optical devices. There are no magnetic fields in the reading or recording of these discs, therefore, they are immune to magnetic fields of any strength, unlike hard drives Due to its immunity to magnetic fields, CD and DVD media is unaffected by Electromagnetic Pulse (EMP) effects, X-rays, and other sources of electromagnetic radiation. The primary consideration with recordable CD media (and to a lesser extent, manufactured media) is energy transfer. It is important to understand that CD and DVD media is read with light, and recordable discs are written with heat. Using an infrared (ILK) laser, data is transferred to a CD or DVD onto a small, focused area that places all of the laser energy onto the target for transfer. It should be noted that all CD and DVD media are sensitive to heat, and recordable media is sensitive to IR, ultraviolet (UV), and other potential intense light sources. Some rewritable media are affected by EPROM erasers, which use an intense UV light source. Various forensic alternative light sources can provide sufficient energy to affect optical media, especially if it is focused on a small area It is not necessarily a question of heat but one of total energy transfer, which can result in heating.

Dave Kleiman

Papers

Overwriting Hard Drive Data: The Great Wiping Controversy

The Official CHFI Study Guide

CD and DVD Forensics

Rootkits for Dummies (For Dummies (Computer/Tech))