What are significant forensic parameters of cloud storage forensics.
It is a very interesting open topic!
How Cloud and BigData scenarios can permit computer forensic?
If we consider a scenario of virtualized distributed enviroments (as cloud storage)
it is really difficult to think that traditional digital forensic metrics and methods can be applied (as forensic copy).
NIST has published the draft about "NIST Cloud Computing
Forensic Science Challenges" that is an interesting document about approaches on
this important topic (you find it as link).
However, if the forensic is focused on client, the problems can be addressed
as brillantly shown by the link attached
that considers method for Dropbox, Skydrive,Google Drive, iCloud.
https://digital-forensics.sans.org/summit-archives/Prague_Summit/Cloud_Storage_Forensics_Mattia_Eppifani.pdf
http://csrc.nist.gov/publications/drafts/nistir-8006/draft_nistir_8006.pdf
Have a look at a paper that we recently published - A State-of-the-Art Review of Cloud Forensics, with the lead author Sameera Almulla - that may give you some ideas.
Technical problem is definitely surpassed in complexity by the legal aspect. Identifying cloud provider is kind of a regular difficulty. But getting access to physical digital media is...Wow! In Canada, even if the provider is canadian, you have to have a court authorization to look in his data store. If the provider is outside Canada, you have to go through MLAT and the whole shebang. And if it's in a non-democratic country or a tax or law shelter country...just forget it.
Technically: Most data stores (for instance Dropbox, namely) are locally synchronized with cloud data. So you can have access to data and intradata (metadata located inside the file itself) but you loose all paradata (metadata located outside the file). Example of paradata that you don't have locally: Dropbox keeps old versions of a document for a certain time.
What if the cloud providing is about virtual machine (for instance AWS or GoGrid or...). It depends on if you have access to admin interface. If so, you can generate a clone of a virtual disk, create a new machine and attach the clone as secondary drive and create a forensic image with FTK Imager. Once the image is created, simply download it. I don't know if the clone of the virtual disk is an exact copy (thing that I will search soon to clarify)...
Check 65 challenges published by NIST in July 2014 that are based on the following :
1. Stakeholders
2. Action
3. Object
4. Reason
- Badges
- Science topic
- Similar topics
- Geoscience
- Asia
- India