A Cloud Forensics Framework to Identify, Gather, and Analyze Cloud Computing Incidents

Abstract

The focus of cloud forensics is cyber-crime cases, no matter the object, the subject, or the environment involved. Each cloud computing environment has a variety of features that make it unique. Challenges associated with cloud forensics can be found at every stage of the digital forensics process. We need to begin by understanding the cloud forensics landscape (the cloud) in order to provide a holistic solution to overcome these challenges. While designing the cloud forensics framework, the elements that make up the cloud should be taken into consideration, which also impact the forensics process within the cloud. An extensive survey of the current state of research in cloud forensics is presented in this paper. Also, a conceptual cloud forensics framework that facilitates the identification, gathering, and analysis of cloud computing events is proposed, utilizing the design science approach. The proposed conceptual cloud forensics framework consists of six stages: identifying incidents, gathering evidence, preserving evidence, analyzing incidents, documenting incidents, and investigating post-incident events. Each stage has several activities and tasks to assist investigators dealing with cloud computing events. Unlike traditional approaches to cloud forensic investigations, the conceptual framework developed in this study is highly applicable.