A survey on cloud forensics challenges and solutions

Abstract

In recent years, cloud computing has gained popularity, and it is now used to support various areas of human life. Cloud forensics has been introduced to help forensic investigators find potential evidence against cloud criminal activities and maintain the security and integrity of the information stored in the cloud. While great research in the area has been carried out concerning challenges and solutions, the research on methodologies and frameworks is still in its infancy. This article focuses on the methodological aspects of cloud forensics. It critically reviews cloud forensics' existing challenges and solutions, and it explores, based on a detailed review of the area, all the work that has been carried out both in digital and cloud forensic methodologies mainly for supporting the investigation of security incidents in cloud. Furthermore, the detailed comparison reveals similarities and drawbacks of the existing methodologies providing some novel future research directions. Finally, the specific paper can be considered as a starting point for researchers wishing to design cloud-forensicable services over the cloud.

A Revised Forensic Process for Aligning the Investigation Process with the Design of Forensic-Enabled Cloud Services

“…However, designing cloud services capable to assist a cloud investigation process is of vital importance and various research efforts concentrate on these directions [8,9]. In addition, digital forensics methods cannot support an investigation in cloud environments since the particular environments introduce many differences compared to traditional IT environments [1,10].…”

“…Authors stated that the preservation stage should also run concurrently with the other two stages or should be included in the chain of custody. Based on the comparison framework and the literature review conducted in [10], Simou et al [9] proposed a generic process for cloud-forensic investigation including the steps of Incident Confirmation, Incident Identification, Collection-Acquisition, Examination-Analysis, and Presentation. They were stating that understanding the cloud forensic investigation process is of vital importance in order to design and implement cloud forensic-enabled services.…”

A framework for designing cloud forensic-enabled services (CFeS)

“…When technologies are applied to activity diagrams, a new service is implemented which is cloud forensic-enabled and ready to support a cloud forensic investigation. For suggesting the adequate technologies per forensic constraint, taking as input the deployment model, the service model and the missing forensic-related constraints, we have grouped a list of possible solutions on our previous papers that categorize the existing solutions based on these criteria [26]. A snapshot of this table is shown in Table 6.…”

“…A detailed review at the respective methods has been also conducted and presented in [26,27]. This analysis revealed the challenges and the open issues related to cloud forensics and their possible solutions.…”

“…This is due to the fact that the cloud forensic process relies on the privacy and security capabilities to help resolve forensic issues. Based on our previous work [26,27,39] regarding the identification of forensic investigation stages, challenges and solutions, we present in the following tables various helpful information related to 7 the identified cloud forensic constraints. The identification and analysis of the information presented in tables 1, 2 and 3 was a mandatory step for the proposed tasks presented in section 4.…”