Investigating Storage as a Service Cloud Platform

Abstract

Due to the flexibility, affordability and portability of cloud storage, individuals and companies envisage the cloud storage as one of the preferred storage media nowadays. This attracts the eyes of cyber criminals, since much valuable information such as user credentials, and private customer records are stored in the cloud. There are many ways for criminals to compromise cloud services; ranging from non-technical attack methods, such as social engineering, to deploying advanced malwares. Therefore, it is vital for cyber forensics examiners to be equipped and informed about best methods for investigation of different cloud platforms. In this chapter, using pCloud (an extensively used online cloud storage service) as a case study, and we elaborate on different kinds of artefacts retrievable during a forensics examination. We carried out our experiments on four different virtual machines running four popular operating systems: a 64bit Windows 8, Ubuntu 14.04.1 LTS, Android 4.4.2, and iOS 8.1. Moreover, we examined cloud remnants of two different web browsers: Internet Explorer and Google Chrome on Windows. We believe that our study would promote awareness among digital forensic examiners on how to conduct cloud storage forensics examination.

Interpol review of digital evidence 2016 - 2019

“…It provides client-side encryption meaning that, as data leaves the client’s system, it is encrypted. Dargahi, Dehghantanha and Conti [ 55 ] conducted a forensic study of pCloud to determine what data can be found on Windows, Ubuntu, Android, and iOS operating systems when using pCloud; what data is leaked when using Google Chrme and Internet Explorer browsers on Windows operating systems; what data of forensic interest can be discovered in live memory’ and, what data can be captured in network traffic?…”

“…In the Windows based browser experiments, uploaded file names and user names could be revealed; passwords, email addresses, file names and directories were discoverable in physical memory as Internet Explorer saves pCloud credentials in the registry. Similarly, username and passwords could be found when Google Chrome was used as the browser [ 55 ].…”

“…In the Android experiments, pCloud specific folders were created and a database containing usernames, email quota, and tables related to pCloud communications could be found. Following deinstallation of the pCloud app, website information and cookies related to pCloud could be found in the memory [ 55 ].…”

“…Some other useful information could be found including “session ID”, “API key”, the pCloud installation directory location, and uploaded file names. Following uninstallation, some deleted files could be recovered [ 55 ].…”

Emerging from the Cloud: A Bibliometric Analysis of Cloud Forensics Studies

“…Table 1 illustrates a summary of mostly used tools to conduct cloud forensics [14] [24] General Drive image acquisition and offline examination Variety of investigation frameworks have been suggested for cloud forensics [25], [26]. Moreover, researchers tried to identify residual evidences of users' interactions with different cloud platforms such as DropBox [27], MEGA [28], GoogleDrive [29], SugarSync [30], pCloud [31], [32], CloudMe [33], SpiderOak [32] and hubiC [34] on Windows, Linux and mobile devices. There were several attempts to extract server-side evidences of different cloud platforms such as Syncany [35], BitTorrent Sync [36], SymForm [37] as well.…”