Although cloud computing is maturing, security issues are still prevalent. Most of the security issues that are in the cloud have existed since the advent of the Internet. These issues are escalated in a cloud environment due to its distributed nature, multi-tenancy and the sensitive and large amount of data that is transmitted over the Internet and hosted by third parties. The security aspect that this paper focuses on concerns digital forensics. The cloud spans over multi-jurisdictions. As such, service providers hosting the data that may be required for digital forensic investigation may be reluctant to comply with foreign law enforcement agencies. Even if they comply, this may be a costly and time-consuming exercise, given the amount of hosted data that belongs to multi-tenants. In this paper we present a forensic readiness model that makes use of a Forensic Service hosted in the cloud. The model is aimed at minimizing costs associated with conducting a digital forensic investigation in a distributed cloud environment. The scope of this paper however is limited to examining the impact that a forensic readiness mechanism put in place may have on other hosted cloud services. Preliminary results have shown a negligible effect in performance of cloud services by a having our proposed digital forensic readiness mechanism in place.

No abstract

Cloud computing is a new computing paradigm that presents fresh research issues in the field of digital forensics. Cloud computing builds upon virtualisation technologies and is distributed in nature. Depending on its implementation, the cloud can span across numerous countries. Its distributed nature and virtualisation introduces digital forensic research issues that include among others difficulty in identifying and collecting forensically sound evidence. Even if the evidence may be identified and essential tools for collecting the evidence are acquired, it may be illegal to access computer data residing beyond the jurisdiction of a forensic investigator. The investigator needs to acquire a search warrant that can be executed in a specific foreign country -which may not be a single country due to the distributed nature of the cloud. Obtaining warrants for numerous countries at once may be costly and time consuming. Some countries may also fail to comply with the demands of cloud forensics. Since the field of digital forensics is itself still in its infancy, it lacks standardised forensic processes and procedures. Thus, digital forensic investigators are able to collect evidence, but often fail in following a valid investigation process that is acceptable in a court of law. In addressing digital forensic issues such as the above, the authors are writing a series of papers that are aimed at providing guidelines for digital forensic procedures in a cloud environment. Live forensics and network forensics constitute an integral part of cloud forensics. A paper that deals with guidelines for digital forensic procedures in live forensics was submitted elsewhere. The current paper is therefore the second in a series where the authors propose and present guidelines for digital forensic procedures in network forensics. The authors eventually aim to have guidelines for digital forensic procedures in a cloud environment as the last paper in the series.

No abstract

No abstract