Cloud forensics

On cloud security requirements, threats, vulnerabilities and countermeasures: A survey

To reduce the risk of digital forensic evidence being called into question in judicial proceedings, it is important to have a rigorous methodology and set of procedures for conducting digital forensic investigations and examinations. Digital forensic investigation in the cloud computing environment, however, is in infancy due to the comparatively recent prevalence of cloud computing. Cloud Storage Forensics presents the first evidence-based cloud forensic framework. Using three popular cloud storage services and one private cloud storage service as case studies, the authors show you how their framework can be used to undertake research into the data remnants on both cloud storage servers and client devices when a user undertakes a variety of methods to store, upload, and access data in the cloud. By determining the data remnants on client devices, you gain a better understanding of the types of terrestrial artifacts that are likely to remain at the Identification stage of an investigation. Once it is determined that a cloud storage service account has potential evidence of relevance to an investigation, you can communicate this to legal liaison points within service providers to enable them to respond and secure evidence in a timely manner. Learn to use the methodology and tools from the first evidenced-based cloud forensic framework Case studies provide detailed tools for analysis of cloud storage devices using popular cloud storage services Includes coverage of the legal implications of cloud storage forensic investigations Discussion of the future evolution of cloud storage and its impact on digital forensics

Cloud Storage Forensics

Cloud log forensics (CLF) mitigates the investigation process by identifying the malicious behavior of attackers through profound cloud log analysis. However, the accessibility attributes of cloud logs obstruct accomplishment of the goal to investigate cloud logs for various susceptibilities. Accessibility involves the issues of cloud log access, selection of proper cloud log file, cloud log data integrity, and trustworthiness of cloud logs. Therefore, forensic investigators of cloud log files are dependent on cloud service providers (CSPs) to get access of different cloud logs. Accessing cloud logs from outside the cloud without depending on the CSP is a challenging research area, whereas the increase in cloud attacks has increased the need for CLF to investigate the malicious activities of attackers. This paper reviews the state of the art of CLF and highlights different challenges and issues involved in investigating cloud log data. The logging mode, the importance of CLF, and cloud log-as-a-service are introduced. Moreover, case studies related to CLF are explained to highlight the practical implementation of cloud log investigation for analyzing malicious behaviors. The CLF security requirements, vulnerability points, and challenges are identified to tolerate different cloud log susceptibilities. We identify and introduce challenges and future directions to highlight open research areas of CLF for motivating investigators, academicians, and researchers to investigate them.

Cloud Log Forensics: Foundations, State of the Art, and Future Directions

Privacy issues have always been a major concern in 
computer forensics and security and in case of any 
investigation whether it is pertaining to computer or 
not always privacy issues appear. To enable 
privacy’s protection in the physical world we need 
the law that should be legislated, but in a digital 
world by rapidly growing of technology and using 
the digital devices more and more that generate a 
huge amount of private data it is impossible to 
provide fully protected space in cyber world 
during the transfer, store and collect data. Since its 
introduction to the field, forensics investigators, 
and developers have faced challenges in finding the 
balance between retrieving key evidences and 
infringing user privacy. This paper looks into 
developmental trends in computer forensics and 
security in various aspects in achieving such a 
balance. In addition, the paper analyses each 
scenario to determine the trend of solutions in these 
aspects and evaluate their effectiveness in resolving 
the aforementioned issues.

/pdf/a-survey-on-privacy-issues-in-digital-forensics-997mir2vi4.pdf

A survey on privacy issues in digital forensics

Cloud computing discusses about sharing any imaginable entity such as process units, storage devices or software. The provided service is utterly economical and expandable. Cloud computing attractive benefits entice huge interest of both business owners and cyber thefts. Consequently, the “computer forensic investigation” step into the play to find evidences against criminals. As a result of the new technology and methods used in cloud computing, the forensic investigation techniques face different types of issues while inspecting the case. The most profound challenges are difficulties to deal with different rulings obliged on variety of data saved in different locations, limited access to obtain evidences from cloud and even the issue of seizing the physical evidence for the sake of integrity validation or evidence presentation. This paper suggests a simple yet very useful solution to conquer the aforementioned issues in forensic investigation of cloud systems. Utilizing TPM in hypervisor, implementing multi-factor authentication and updating the cloud service provider policy to provide persistent storage devices are some of the recommended solutions. Utilizing the proposed solutions, the cloud service will be compatible to the current digital forensic investigation practices; alongside it brings the great advantage of being investigable and consequently the trust of the client.

/pdf/forensics-investigation-challenges-in-cloud-computing-4a9tit7x7v.pdf

Forensics investigation challenges in cloud computing environments

Nowadays mobile phones are used all over the world for the communication purposes. The capabilities of these devices are improved during the past few years. Due to their capabilities, mobile devices are used broadly in criminal activities especially in cybercrime. The volatile data stored in mobile phones usually contain important evidences regarding the crime. However, collecting these volatile data in a forensically sound manner would not be easy. This paper proposes a new approach for acquiring the volatile data inside a mobile phone in a forensically sound manner that minimizes the chance of evidence modification or lost.

/pdf/volatile-memory-acquisition-using-backup-for-forensic-15q45r5btn.pdf

Volatile memory acquisition using backup for forensic investigation

Unfortunately, the nature of the cloud is in conflict with the characteristic of digital forensic investigation approach since many of the common forensic steps are
not possible to follow during the inspection of the case. The distribution of cloud resource location in different countries, utilization of numerous storage devices and
very limited physical access to the low-level storage devices and physical memories are just some of the reasons caused this conflict. This paper proposes some basic, yet
useful, solutions to conquer the described issues. Implementing multi-factor authentication, utilizing Trusted Platform Module (TPM) in Hypervisor and applying specific changes in the Cloud Service Provider (CSP) contract to provide persistent storage to the customer are parts of suggested approaches, capable of making the current digital forensic investigation practices applicable to the cloud computing environments. This is an absolutely essential requirement for CSP’s mainly due to the significance of the clients’ trust which demands the ability for being investigated.

Cloud computing and conflicts with digital forensic investigation

All operating systems are employing some sort of logging mechanism to track and note users activities and Microsoft Windows is not an exception. Log Analysis is one of the important parts of Windows forensics process. The Windows event log system introducing in Windows NT was released with a new feature for Microsoft Windows family and since then went through several major changes and updates. The event log experienced major updated in Windows 8. This paper first introduces Windows 8 event log format and then proceeds with explaining methods for analyzing the logs for digital investigation and incident handling. The main contributions of this paper are introducing Windows8 logging service and forensic examination of it.

Ramlan Mahmoud

Papers

Forensics investigation challenges in cloud computing environments

Volatile memory acquisition using backup for forensic investigation

Cloud computing and conflicts with digital forensic investigation

Introducing and analysis of the Windows 8 event log for forensic purposes