Acquiring forensic evidence from infrastructure-as-a-service cloud computing: Exploring and evaluating tools, trust, and techniques

Digital Investigation

Volumn 9, Issue SUPPL., 2012, Pages

  Dykstra, Josiah ^a   Sherman, Alan T ^a  

^a UNIVERSITY OF MARYLAND BALTIMORE COUNTY   (United States)

Author keywords

Amazon EC2; Cloud computing; Cloud forensics; Computer security; Digital forensics; EnCase; FTK

Indexed keywords

CLOUD COMPUTING; COMPUTER CRIME; COMPUTER FORENSICS; DIGITAL FORENSICS; INFRASTRUCTURE AS A SERVICE (IAAS); LAWS AND LEGISLATION; SECURITY OF DATA;

AMAZON EC2; CLOUD FORENSICS; CLOUD SERVICE PROVIDERS; ENCASE; FORENSIC ACQUISITION; FORENSIC EVIDENCE; MANAGEMENT PLANES; NON-VOLATILE DATA;

TRUSTED COMPUTING;

EID: 84864596423     PISSN: 17422876     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.diin.2012.05.001     Document Type: Conference Paper

References (31)

1. Amazon Web Services AWS import/export 2011 Available at: http://aws.amazon.com/importexport/ [accessed 28.12.11]
2. E. Casey Digital evidence and computer crime: forensic science, computers, and the Internet 2nd ed. 2004 Elsevier Academic Press Amsterdam
3. M. Conover, and T. Chiueh Code injection from the hypervisor: removing the need for in-guest agents Proceedings of Blackhat USA 2008 [accessed 01.11.11]
4. B. Dolan-Gabitt, B. Payne, and W. Lee Leveraging forensic tools for virtual machine introspection Technical Report, Georgia Institute of Technology, GT-CS-11-05 2011
5. J. Dykstra, and A.T. Sherman Understanding issues in cloud forensics: two hypothetical case studies Proceedings of the 2011 ADFSL conference on digital forensics security and law 2011 ASDFL 191 206
6. J. Dykstra, and A.T. Sherman Understanding issues in cloud forensics: two hypothetical case studies Journal of Network Forensics 3 1 2011 19 31
7. Eucalyptus Eucalyptus: the open source cloud platform 2011 Available at: http://open.eucalyptus.com/ [accessed 01.11.11]
8. Federal CIO Council Guidelines for the secure use of cloud computing by federal departments and agencies (draft version 0.41) 2011
9. S. Garfinkel Forensic feature extraction and cross-drive analysis Digital Investigation 3 2006 71 81 (Pubitemid 44066907)
10. T. Garfinkel, and M. Rosenblum A virtual machine introspection based architecture for intrusion detection Proceedings of the 10th annual symposium on Network and Distributed System Security (NDSS 2003) 2003 191 206
11. R. Giobbi, and J. McCormick Vulnerability Note VU#912593: Guidance EnCase Enterprise uses weak authentication to identify target machines 2007 Available at: http://www.kb.cert.org/vuls/id/912593 [accessed 21.09.11]
12. Guidance Software EnCase Legal Journal 2011 Available at: http://www.guidancesoftware.com/DocumentRegistration.aspx?did=1000017380 [accessed 21.09.11]
13. J. Heiser Remote forensics software Gartner RAS Core Research Note G00171898 2009
14. Krautheim FJ. Building trust into utility cloud computing. Ph.D. thesis; Department of Electrical Engineering and Computer Science, University of Maryland, Baltimore County; Baltimore, Maryland; 2010.
15. F.J. Krautheim, D.S. Phatak, and A.T. Sherman Trusted virtual environment module: managing trust in cloud computing 3rd international conference on trust and trustworthy computing 2010 211 227
16. LibVMI Virtual Machine Introspection (VMI) tools 2011 Available at: http://vmitools.sandia.gov/ [accessed 01.11.11]
17. K. Nance, B. Hay, and M. Bishop Investigating the implications of virtual machine introspection for digital forensics Proceedings of the international conference on Availability, Reliability and Security (ARES '09) 2009 1024 1029
18. National Institute of Standards and Technology Computer forensic tool testing (CFTT) project overview 2003 Available at: http://www.cftt.nist.gov/ project-overview.htm [accessed 21.09.11]
19. National Institute of Standards and Technology Digital data acquisition tool specification 2004 Available at: http://www.cftt.nist.gov/Pub-Draft-1-DDA- Require.pdf [accessed 21.09.11]
20. National Institute of Standards and Technology Test results for digital data acquisition tool: FTK imager 2.5.3.14 2008 Available at: http://www.ncjrs.gov/pdffiles1/nij/222982.pdf [accessed 21.09.11]
21. National Institute of Standards and Technology Test results for digital data acquisition tool: EnCase 6.5 2009 Available at: http://www.ncjrs.gov/ pdffiles1/nij/228226.pdf [accessed 21.09.11]
22. National Institute of Standards and Technology The NIST definition of cloud computing 2011 Available at: http://csrc.nist.gov/publications/nistpubs/ 800-145/SP800-145.pdf [accessed 08.01.12]
23. K. Ruan, J. Carthy, T. Kechadi, and M. Crosbie Cloud forensics: an overview Advances in digital forensics VII 2011
24. M. Santana Cloud security: beyond the buzz 2009 Available at: http://www.linuxworldexpo.com/storage/10/documents/CI7%20Mario%20Santana.pdf [accessed 21.09.11]
25. N. Santos, K. Gummadi, and R. Rodrigues Towards trusted cloud computing Proceedings of USENIX HotCloud 2009 Available at: http://static.usenix.org/ events/hotcloud09/tech/full-papers/santos.pdf [accessed 19.05.12]
26. H. Sato, A. Kanai, and S. Tanimoto A cloud trust model in a security aware cloud Proceedings of the 2010 10th IEEE/IPSJ international symposium on applications and the Internet. SAINT '10 2010 121 124
27. SCMagazine Best computer forensic tool SCMagazine 2011 [accessed 01.11.11]
28. C. Shields, O. Frieder, and M. Maloo A system for the proactive, continuous, and efficient collection of digital forensic evidence The proceedings of the eleventh annual DFRWS conference vol. 8 2011 S3 13
29. M. Taylor, J. Haggerty, D. Gresty, and D. Lamb Forensic investigation of cloud computing systems Network Security 2011 3 2011 4 10
30. Terremark Secure information services 2009 Available at: http://www.terremark.com/uploadedFiles/Services/Security-Services/TMRK- SIS-Gatefold2-4pagelayout-Screen.pdf [accessed 01.11.11]
31. United States Code Communications Assistance for Law Enforcement Act (CALEA) 47 USC 1001-1010 1994