Overview of the Forensic Investigation of Cloud Services

Abstract

Abstract-Cloud Computing is a commonly used, yet ambiguous term, which can be used to refer to a multitude of differing dynamically allocated services. From a law enforcement and forensic investigation perspective, cloud computing can be thought of as a double edged sword. While on one hand, the gathering of digital evidence from cloud sources can bring with it complicated technical and cross-jurisdictional legal challenges. On the other, the employment of cloud storage and processing capabilities can expedite the forensics process and focus the investigation onto pertinent data earlier in an investigation. This paper examines the state-of-the-art in cloud-focused, digital forensic practises for the collection and analysis of evidence and an overview of the potential use of cloud technologies to provide Digital Forensics as a Service.

Shining a light on Spotlight: Leveraging Apple's desktop search utility to recover deleted file metadata on macOS

“…Examining application generated databases is not only an important task for forensic analysis of the data generation software tools, e.g., desktop applications and web browsers (Buchholz and Spafford, 2004), mobile applications (Faheem et al, 2015), and cloud services (Farina et al, 2015), but has been identified for desktop metadata curators, such as desktop file search utilities. Turnbull and Slay (Turnbull and B.BSlay, 2006) emphasised the importance of conducting research into the databases used by Google Desktop Search technologies in order for tools to be designed to extract the data for digital forensic investigations.…”

Improving Borderline Adulthood Facial Age Estimation through Ensemble Learning

“…Furthermore, the 12,792 images used for training and testing (80% and 20% respectively) came from sources described in Section 4. Each input image was resized to a dimension of 224 x 224 pixels and the output had a size of 5 (Multi-class classifier) and were mapped to a value pertaining to the following age range classes: [0-5], [6][7][8][9][10], [11][12][13][14][15], [16][17] and [18][19][20][21][22][23][24][25]. The ranges were adapted from the "Criminal networks involved in the trafficking and exploitation of underage victims in the European Union" 2018 report 14 , which indicates that the classification of subjects into one of these age ranges is sufficient, and that precise age estimation is not crucial for investigators.…”

“…Child exploitation investigations are one of the more common investigation types in digital forensic laboratories throughout the world [1]. These investigations have become an arduous task due to the increasing usage of anonymization tools, private P2P networks and cloud-based KVM systems [9]. Worldwide, law enforcement and child protection communities have been fighting to diminish CSEM and human trafficking.…”

A survey on cloud forensics challenges and solutions

“…Evidence retrieval in multi‐tenant environments must maintain the confidentiality, preserve the privacy of the tenants, and finally ensure that the data to be collected concern specific tenant and no other. “Any attempt to physically connect to a data store or virtual host system will run a risk of modifying data that is outside the scope of the investigation insofar as belonging to a system that is not owned or operated by the suspect named in the warrant” . Because of the multi‐tenancy, the data can be contaminated by people who have access into the same storage unit with result of losing important evidence.…”

“…Thus, it is very difficult, almost impossible, to conduct evidence acquisition when investigators are dealt with different legal systems, where the related laws or regulations may vary by countries . A court order issued in the jurisdiction that resides a data center may not be applicable to the jurisdiction that resides another . “The location of data affects the ability to compel production of such data and may, although unlikely under most states’ in USA and countries long arm jurisdiction rules, affect the determination of where a case involving cloud data must be filed/prosecuted” .…”