Implications of Cloud Computing on Digital Forensics

Abstract

Cloud computing is a paradigm for computing services that are delivered to users over the Internet. In cloud computing, users rent rather than buy their computing resources. Cloud computing likely represents the next stage in the evolution of the Internet. But the cloud computing paradigm is still developing, with numerous unknowns and many questions open for research. One critical question that has not received much attention is security. A significant subset is digital forensicsthat is, (1) the discovery of evidence remaining on a computer after a security breach or attack and (2) the use of that evidence to investigate the event and establish facts for use in legal proceedings.This paper discusses the impact that cloud computing will have on digital forensics. From a forensic perspective, cloud computing raises a number of concerns. Most immediate is whether or not forensic practitioners will be able to analyze the Cloud using existing techniques of digital forensics. During a traditional forensic examination, files on the storage media are examined along with the entire file system structure. But this may not be a practical model for examinations in the Cloud, where the computer is virtual, that is, where numerous heterogeneous resources, often geographically distributed, are combined. Other concerns include protecting evidence against contamination and anticipating the legal issues that will be raised by the Cloud paradigm, with its resources spread over diverse administrative and geopolitical domains. Comprehensive security services to protect not only the Cloud's resources but also the data that resides on them may need to be instituted. The open literature to date has yet to address any of these challenges.Cloud technologies are predicted to cause a paradigm shift in digital forensic techniques. This paper discusses the application of traditional digital forensic examinations to cloud forensics.