Cloud log forensics metadata analysis

Proceedings - International Computer Software and Applications Conference

Volumn , Issue , 2012, Pages 194-199

  Thorpe, Sean ^a   Ray, Indrajit ^b   Grandison, Tyrone ^c   Barbir, Abbie ^d  

^a UNIVERSITY OF TECHNOLOGY   (Jamaica)

^b University Services Building   (United States)

^c IBM RESEARCH   (United States)

^d Bank of America ^*  (United States)

Author keywords

Cloud; Forensics; Hypervisor; Logs; Metadata

Indexed keywords

CRIMINAL ACTIVITIES; DATA CLOUDS; FORENSIC INFORMATION; FORENSICS; HYPERVISOR; LOGS; METADATA ANALYSIS; ON CURRENTS; VIRTUAL MACHINES;

CLOUDS; COMPUTER SOFTWARE; SOFTWARE ENGINEERING;

METADATA;

EID: 84870803956     PISSN: 07303157     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/COMPSACW.2012.44     Document Type: Conference Paper

References (24)

1. James P. Anderson. Computer security threat monitoring and surveillance. Technical report, James P. Anderson Co., April 1980.
2. Peter Meli. Timothy Granee. NIST Definition of Cloud Computing. Retrieved from: http://csrc.nist.gov/publications/nistpubs/800-145/SP800-145.pdf, September 2009.
3. Florian Buchholz . Pervasive binding of labels to system processes. In Proceedings of the published Phd thesis, August 2005. Retrieved from https://users.cs.jmu.edu/buchhofp/publications/buchholz-thesis.pdf2.
4. Florian Buchholz and Clay Shields. Providing process origin information to aid in computer forensic investigations. Journal of Computer Security, 12(5):753-776, September 2004.
5. Michael A. Caloyannides. Computer Forensics and Privacy. Artech House, Norwood, MA, 2001.
6. R.Card, Theodore Ts'o, and Stephen Tweedie. Design and implementation of the second extended file system. In Frank B. Brokken et al, editor, Proceedings of the First Dutch International Symposium on Linux, 1994.
7. B. Carrier and C. Shields. A recursive session token protocol for use in computer forensicsand TCP traceback. In Proceedings of the IEEE Infocomm 2002, June 2002.
8. Brian Carrier. Sleuthkit and autopsy forensic browser. http://www.sleuthkit.org.
9. Brian D. Carrier and Eugene H. Spafford. Defining event reconstruction of digital crime scenes. Journal of Forensic Sciences, 49(6), 11 2004. CERIAS TR 2004-37.13
10. Eoghan Casey, editor. Handbook of Computer Crime Investigation. Academic Press, San Diego, CA, 2002.
11. Eoghan Casey. Digital Evidence and Computer Crime. Academic Press, San Diego, CA, second edition, 2004.
12. Franklin Clark and Ken Diliberto. Investigating Computer Crime. CRC Press, Boca Raton, FL, 1996.
13. R.C. Daley and P. G. Neumann. A general-purpose file system for secondary storage. In FallJoint Computer Conference, 1965.
14. Dorothy E. Denning and Peter F. Mac Doran. Location-based authentication: grounding cyberspace for better security. In Internet besieged: countering cyberspace scofflaws, pages 167-174. ACM Press/Addison-Wesley Publishing Co., 1998.
15. Encase forensic software, http://www.guidancesoftware.com.
16. Dan Farmer and Wietse Venema. The coroner's toolkit. http://www. porcupine.org.
17. J. Chapman Flack and Mikhail Atallah. A toolkit for modeling and compressing audit data. Technical report, COAST, Purdue University, 1998. COAST TR 98-20.
18. [ The forensic toolkit. http://www.accessdata.com/Product04-Overview.htm.
19. S. Garfinkel, G. Spafford, and A. Schwartz. Practical Unix and Internet Security. O'Reilly, third edition, 2003.
20. Sean Thorpe, Indrajit Ray. File timestamps in a cloud digital investigation. Journal of Information Assurance and Security. ISSN 1554-1010 Volume 6 (March 2011) pp. 495-502
21. Sean Thorpe, Indrajit Ray. Detecting temporal inconsistency in virtual machine activity timelines. Proceedings of Journal of Information Assurance and Security (JIAS), Volume 7. No.1, April 2012.
22. Sean Thorpe, Indrajit Ray, Indrakshi Ray, Tyrone Grandison."A formal temporal log data model for the global synchronized virtual machine environment". International Journal of Information Assurance and Security (JIAS), Volume 6, No 2. 2011.
23. D.Riley, C.Wren, T.Berry."Cloud computing :Forensic challenges for law enforcement. Proceedings of the International Conference for Internet Technology and Secured Transactions, London, UK, Nov.2010
24. Paul J. Leach and Rich SaIz. Uuids and guids. http://www.webdav.org/ specs/draft-leach-uuids-guids-01.txt.