CloudForen: A Novel Framework for Digital Forensics in Cloud Computing

Mathew Nyamagwa¹, Jigang Liu¹, Anyi Liu², Tetsutaro Uehara³

(1.Dept. of Information and Computer Sciences, Metropolitan State University, Saint Paul 55106,USA; 2.Dept. of Computer Science, Indiana University Purdue University Fort Wayne, Fort Wayne 46805, Indianan,USA;3.Dept. of Computer Science, College of Information Science ＆ Engineering, Ritsumeikan University, Kusatsu 5258755, Shiga, Japan)



Abstract:

Since its birth in the early 90’s, digital forensics has been mainly focused on collecting and examining digital evidence from computers and networks that are controlled and owned by individuals or organizations. As cloud computing has recently emerged as a dominant platform for running applications and storing data, digital forensics faces well-known challenges in the cloud, such as data inaccessibility, data and service volatility, and law enforcement lacks control over the cloud. To date, very little research has been done to develop efficient theory and practice for digital forensics in the cloud. In this paper, we present a novel framework, CloudForen, which systematically addresses the challenges of forensics in cloud computing. CloudForen covers the entire process of digital forensics, from the initial point of complaint to the final point where the evidence is confirmed. The key components of CloudForen address some challenges, which are unique to the cloud. The proposed forensic process allows cloud forensic examiner, cloud provider, and cloud customer collaborate naturally. We use two case studies to demonstrate the applicability of CloudForen. We believe CloudForen holds great promise for more precise and automatic digital forensics in a cloud computing environment.

Key words:  digital forensics, cloud computing, framework

DOI：10.11916/j.issn.1005-9113.2014.06.008

Clc Number:TP39

Fund: