A Survey of Various Frameworks and Solutions in all Branches of Digital Forensics with a Focus on Cloud Forensics

Abstract

Digital forensics is a class of forensic science interested with the use of digital information produced, stored and transmitted by various digital devices as source of evidence in investigations and legal proceedings. Digital forensics can be split up to several classes such as computer forensics, network forensics, mobile forensics, cloud computing forensics, and IoT forensics. In recent years, cloud computing has emerged as a popular computing model in various areas of human life. However, cloud computing systems lack support for computer forensic investigations. The main goal of digital forensics is to prove the presence of a particular document in a given digital device. This paper presents a comprehensive survey of various frameworks and solutions in all classes of digital forensics with a focus on cloud forensics. We start by discussing different forensics classes, their frameworks, limitations and solutions. Then we focus on the methodological aspect and existing challenges of cloud forensics. Moreover, the detailed comparison discusses drawbacks, differences and similarities of several suggested cloud computing frameworks providing future research directions.

Research Trends, Challenges, and Emerging Topics in Digital Forensics: A Review of Reviews

“…From this summary, we observe that there is a dearth of research work focusing on cloud forensic standard tools and technologies in the cloud environment. Also, very limited works have concentrated on pointing out the feasible Update forensic tools to fight novel cybercrime [19], [21], [22], [25], [26], [29] Lack of forensic readiness mechanisms and their management [20], [22], [25], [29], [31] Data management and its fragmentation hinders investigations [19]- [22], [24], [26]- [28], [31] Lack of trust and robust chain of custody preservation [19]- [22], [24], [25], [31] Lack of jurisdictional mechanisms for confidential data [24], [26], [31] Cross border investigations due to different jurisdictions and laws [19]- [22], [24] Lack of training and interoperability between investigators and court [21] Anti-forensics [19] B. NETWORKS Data monitoring and acquisition from network traffic are mandatory to prevent most of nowadays cyber-attacks [32]- [34], including, but not limited to, Distributed Denial of Service (DDoS), phishing, DNS tunnelling, Man-in-the-middle (MitM) attacks, SQL injection and others [35], [36].…”

IoT Forensic Frameworks (DFIF, IoTDOTS, FSAIoT): A Comprehensive Study

“…Digital forensics is a branch of forensic science concerned with investigating cybercrimes by processing digital data and information to get evidence. The purpose of these evidences after they have gone through systematic stages of discovery, examination, collection, and storage, as well as taking care during these stages to maintain the integrity and effectiveness of evidence when presented as legally considered evidence before competent courts [15,16].…”

Investigation Framework for Cloud Forensics using Dynamic Genetic-based Clustering

“…Digital forensics is a science which is defined by many researchers, see [31] [20], as a science of retrieving, examining, and analysing digital evidences collected from digital devices. A Digital evidence, according to [20], is defined as the information and data of investigative value that is stored on, received, or transmitted by a digital device.…”

“…The model contains all conventional stages of digital forensics. This framework is classified as a simple framework based on [31]. And other models that fall under general framework such as the model suggested through [40], [8], [32], and [7].…”

“…Numerous frameworks and solutions have been proposed in other digital forensics branches [31], [47]. One instance includes the frameworks and solutions proposed in the IoT forensics branch, which refer to one of the digital forensics branches, such as the one in [13].…”