Cloud Storage Forensics

Cloud Storage Forensics

Volumn , Issue , 2013, Pages 1-189

  Quick, Darren ^a   Martini, Ben ^a   Choo, Kim Kwang Raymond ^b  

^a South Australia Police ^*

^b UNIVERSITY OF SOUTH AUSTRALIA   (Australia)

Author keywords

[No Author keywords available]

Indexed keywords

EID: 84902429611     PISSN: None     EISSN: None     Source Type: Book    
DOI: 10.1016/C2013-0-09718-6     Document Type: Book

References (167)

1. ACPO. (2006). Good practice guidelines for computer based evidence v4.0, from Accessed 26.01.13. .
2. Chung, H., Park, J., Lee, S., & Kang, C. (2012). Digital forensic investigation of cloud storage services, from Accessed 26.01.13. .
3. Duffy, A. (2010). Faraday Bag testing in a reverberation chamber - a preliminary study, from Accessed 26.01.13. .
4. Kleynhans, S. (2012). The New PC Era- The Personal Cloud, from Accessed 26.01.13. .
5. Klimt, B., & Yang, Y. (2004). Introducing the Enron corpus. Paper presented at the First conference on email and anti-spam (CEAS).
6. Laugesen, J., & Yuan, Y. (2010). What Factors Contributed to the Success of Apple's iPhone? Paper presented at the Mobile Business and 2010 Ninth Global Mobility Roundtable (ICMB-GMR), 2010 Ninth International Conference on.
7. McClain, F. (2011, 31 May 2011). Dropbox Forensics, from Accessed 26.01.13. .
8. Microsoft. (2008). How NTFS reserves space for its Master File Table (MFT), from Accessed 26.01.13. .
9. Microsoft. (2012a). Shortcuts: frequently asked questions', from Accessed 26.01.13. .
10. Microsoft. (2012b). What is the prefetch folder? from Accessed 26.01.13. .
11. Mueller, L. (2010). Windows 7 Forensics - Part IV - Thumbcache_*.db' Retrieved 29 March, 2013, from Accessed 26.01.13. .
12. NIJ. (2008). Electronic crime scene investigation: A guide for first responders (2nd ed.), from Accessed 26.01.13. .
13. NIST. (2012). NIST computer forensic tool testing, from Accessed 26.01.13. .
14. Quick D., Choo K-K.R. Digital droplets: Microsoft SkyDrive forensic data remnants. Future Generation Computer Systems 2013, 29(6):1378-1394.
15. Quick D., Choo K-K.R. Dropbox analysis: Data remnants on user machines. Digital Investigation 2013, 10(1):3-18.
16. SAI HB 171-2003 Guidelines for the management of IT evidence 2003, Standards Australia, Sydney, Australia.
17. Taylor M., Haggerty J., Gresty D., Lamb D. Forensic investigation of cloud computing systems. Network Security 2011, 2011(3):4-10.
18. USDoD. (1995). DoD 5220.22-M-Sup 1, National Industrial Security Program Operating Manual Supplement, from Accessed 26.01.13. .
19. W3Counter. (2012). Browser Statistics July 2012, from Accessed 26.01.13. .
20. Zhu, M. (2011). Mobile Cloud Computing: implications to smartphone forensic procedures and methodologies. AUT University.
21. Anderson R., Barton C., Böhme R., Clayton R., van Eeten M., Levi M., et al. (2012). Measuring the cost of cybercrime. Proceedings of the 11th workshop on Economics of Information Security (WEIS 2012) 2011, Berlin Brandenburg Academy of Sciences, Berlin, Germany, 25-26 June.
22. Australian Crime Commission (ACC) Serious and organised investment fraud in Australia 2012, Australian Crime Commission, Canberra, ACT.
23. Australian Government Attorney-General's Department Australian Government Policy and Risk management guidelines for the storage and processing of Australian Government information in outsourced or offshore ICT arrangements 2013, Australian Government Attorney-General's Department, Barton, ACT.
24. Australian Government Parliamentary Joint Committee on Intelligence and Security. (2012). Proof Committee Hansard (Public) Wednesday, 5 September 2012. . .
25. Bartholomew D. Cloud rains opportunities for software developers. Dice 2009, 29 May 2009.
26. Birk, D., & Wegener, C. (2011). Technical issues of forensic investigations in cloud computing environments. In: Proceedings of 6th international workshop on systematic approaches to digital forensic engineering (IEEE/SADFE 2011) (pp. 1-10). Oakland, CA, USA.
27. Bogatin D. Google CEO's new paradigm: 'Cloud computing and advertising go hand-inhand'. Zdnet 2006, 2006. 23 April. .
28. Brenner S. Cybercrime investigation and prosecution: The role of penal and procedural law. Murdoch University Electronic Journal of Law 2001, 8(2). .
29. Caldwell A. Cybercrime cost Australia over $4.5 billion last year. ABC Radio National 2011, 8 September, http://www.abc.net.au/am/content/2011/s3312727.htm.
30. Choo, K.-K. R. (2009a). Online child grooming: A literature review on the misuse of social networking sites for grooming children for sexual offences. Research and public policy No 103, Canberra, ACT: Australian Institute of Criminology.
31. Choo K.-K.R. Responding to online child sexual grooming: An industry perspective. Trends & Issues in Crime and Criminal Justice 2009, 379:1-6.
32. Choo K.-K.R. Cloud computing: Challenges and future directions. Trends & Issues in Crime and Criminal Justice 2010, 400:1-6.
33. Choo K.-K.R. The cyber threat landscape: Challenges and future research directions. Computers & Security 2011, 30(8):719-731.
34. Choo, K.-K. R., Smith, R., & McCusker, R. (2007). Future directions in technology-enabled crime: 2007-09. Research and public policy series No 78, Canberra, ACT: Australian Institute of Criminology.
35. Chung H., Park J., Lee S., Kang C. Digital forensic investigation of cloud storage services. Digital Investigation 2012, 9(2):81-95.
36. Desisto R.P., Plummer D.C., Smith D.M. Tutorial for understanding the relationship between cloud computing and SaaS 2008, Gartner, Stamford, CT.
37. Detica The cost of cyber crime: A Detica report in partnership with the Office of Cyber Security and Information Assurance in the cabinet office 2012, Detica, Surrey, UK.
38. European Network and Information Security Agency (ENISA) Procure secure: A guide to monitoring of security service levels in cloud contracts 2012, European Network and Information Security Agency, Heraklion, Greece.
39. FireEye The advanced cyber attack landscape 2013, FireEye, Inc, Milpitas, CA.
40. Florencio D., Herley C. Sex, lies and cybercrime. Proceedings of the Tenth Workshop on Economics of Information Security (WEIS 2011) 2011, George Mason University, USA, 14-15 June.
41. Gartner. (2012). Gartner says that consumers will store more than a third of their digital content in the cloud by 2016. .
42. Google. (2013). Google trends: Cloud computing. .
43. Gray P. Exposing Norton's cybercrime scare campaign. The Age 2011, 21 September, .
44. Guinchard A. Between hype and understatement: Reassessing cyber risks as a security strategy. Journal of Strategic Security 2011, IV(2):75-96.
45. Harrington S. Collaborating with a digital forensics expert: Ultimate tag-team or disastrous duo?. William Mitchell Law Review 2011, 38(1):354-393.
46. Kaufman L.M. Data security in the world of cloud computing. IEEE Security & Privacy 2009, July/August:61-64.
47. Kovar J. Storage-As-A-Service poised for big boost. CRN 2009, 1291:14-18.
48. Ludwig S. Microsoft confirms it will change SkyDrive name after trademark suit. Venturebeat.com 2013, 31 July, http://venturebeat.com/2013/07/31/microsoft-changing-skydrive-name/%23f7TzSaVh4WmxQh6Z.99.
49. Iorga, M. (2012). Challenging security requirements for US government cloud computing adoption. .
50. Martini B., Choo K.-K.R. An integrated conceptual digital forensic framework for cloud computing. Digital Investigation 2012, 9(2):71-80.
51. Martini B., Choo K.-K.R. Cloud storage forensics: ownCloud as a Case Study. Digital Investigation, In press 2013, http://dx.doi.org/10.1016/j.diin.2013.08.005.
52. Marty, R. (2011). Cloud application logging for forensics. In: Proceedings of 2011 ACM symposium on applied computing, Taichung, Taiwan, pp. 178-184.
53. McGee, K. (2011). The 2011 Gartner scenario: Current states and future directions of the IT industry. Gartner.
54. Meky M., Ali A. A novel and secure data sharing model with full owner control in the cloud environment. International Journal of Computer Science and Information Security 2011, 9(6):12-17.
55. Mell P., Grance T. The NIST definition of cloud computing: Recommendations of the National Institute 2011, NIST Special Publication, 800-415.
56. Norton-Symantec Cybercrime report: The human impact 2011, Symantec Corporation, Mountain View, CA.
57. Overby S. Keeping secrets in the cloud: how to protect your intellectual property in the cloud. CIO Magazine 2012, 6 February, .
58. Quick D., Choo K.-K.R. Digital droplets: Microsoft SkyDrive forensic data remnants. Future Generation Computer Systems 2013, 29(6):1378-1394.
59. Quick D., Choo K.-K.R. Dropbox analysis: Data remnants on user machines. Digital Investigation 2013, 10(1):3-18.
60. Quick D., Choo K.-K.R. Google drive: Forensic analysis of data remnants. Journal of Network and Computer Applications 2013, In press.
61. Quick D., Choo K.-K.R. Forensic collection of cloud storage data: Does the act of collection result in changes to the data or its metadata?. Digital Investigation 2013, 10(3):266-277.
62. Richards, K. (2009). The Australian business assessment of computer user security: A national survey. Research and public policy series No 102, Canberra, ACT: Australian Institute of Criminology.
63. Smith, D. M. (2011). Hype cycle for cloud computing, 2011. G00214915, Gartner.
64. Symantec Cyber crime has surpassed illegal drug trafficking as a criminal moneymaker; 1 in 5 will become a Victim. Press Release 2009, 10 September, .
65. Tendulkar, R. (2013). Cyber-crime, securities markets and systemic risk: Joint Staff Working Paper of the IOSCO Research Department and World Federation of Exchanges. .
66. Vincent M., Hart N. Law in the cloud. Law Society Journal 2011, 49(5):50-51.
67. Waters J. Cloud-based data storage. The Education Digest 2011, 76(8):28-34.
68. Wipperfeld M. How to choose a storage as a service provider. eWeek 2009, 18 February.
69. ACPO (2006). Good Practice Guidelines for Computer Based Evidence v4.0, from .
70. Baryamureeba V., Tushabe F. The enhanced digital investigation process model. Asian Journal of Information Technology 2006, 5(7):790-794.
71. Birk, D. (2011). Technical Challenges of Forensic Investigations in Cloud Computing Environments. Paper presented at the Workshop on Cryptography and Security in Clouds, IBM Forum Switzerland, Zurich.
72. Butler A., Choo K.K.R. IT standards and guides do not adequately prepare IT practitioners to appear as expert witnesses: An Australian perspective. Security Journal 2013, In press.
73. Haggerty J., Taylor M. Managing corporate computer forensics. Computer Fraud and Security 2006, 2006(6):14-16. doi: citeulike-article-id:6856200.
74. Kent, K., Chevalier, S., Grance, T., & Dang, H. (2006). Guide to Integrating Forensic Techniques into Incident Response. SP800-86, Gaithersburg: U.S. Department of Commerce.
75. Martini B., Choo K.K.R. An integrated conceptual digital forensic framework for cloud computing. Digital Investigation 2012, 9(2):71-80.
76. McKemmish R. What is forensic computing?. Trends and Issues in Crime and Criminal Justice, Australian Institute of Criminology 1999, 118:1-6.
77. NIJ. (2004). Forensic examination of digital evidence: A guide for law enforcement, from .
78. NIJ. (2008). Electronic crime scene investigation: A guide for first responders (2nd ed.), from .
79. Peisert S., Bishop M., Marzullo K. Computer forensics in forensis. ACM SIGOPS Operating Systems Review 2008, 42(3):112-122.
80. Quick D., Choo K.K.R. Digital droplets: Microsoft SkyDrive forensic data remnants. Future Generation Computer Systems 2013, 29(6):1378-1394.
81. Quick D., Choo K.K.R. Dropbox analysis: Data remnants on user machines. Digital Investigation 2013, 10(1):3-18.
82. Ratcliffe J. Intelligence-led policing. Trends and Issues in Crime and Criminal Justice 2003, 248:1-6.
83. SAI HB 171-2003 Guidelines for the management of IT evidence 2003, Standards Australia, Sydney, Australia.
84. Slay J., Lin Y., Turnbull B., Beckett J., Lin P. Towards a formalization of digital forensics. Advances in Digital Forensics V IFIP AICT 2009, 2009:37-47.
85. Taylor M., Haggerty J., Gresty D., Lamb D. Forensic investigation of cloud computing systems. Network Security 2011, 2011(3):4-10.
86. Willassen, S. (2008). Using simplified event calculus in digital investigation. Paper presented at the SAC '08: Proceedings of the 2008 ACM symposium on Applied computing, Fortaleza, Ceara, Brazil.
87. Yeager, R. (2006). Criminal computer forensics management. Paper presented at the InfoSecCD '06: Proceedings of the third annual conference on Information security curriculum development, Kennesaw, Georgia.
88. Architecture Technologies. (2011). Dropbox Reader V1.1 2011 (Google Cache), viewed 23 January 2013, Accessed 10.02.13. .
89. Association of Chief Police Officers (ACPO). (2006). Good Practice Guidelines for Computer Based Evidence v4.0. Accessed 10.02.13. .
90. Dropbox. (2012). Contact web page - legal inquiries. Accessed 10.02.13. https://www.dropbox.com/contact/.
91. Kisswani N.M. Telecommunications (Interception and Access) and its regulation in arab countries 2010, Vol. 5. J. Int'l Com. L. & Tech., p. 225.
92. Martini B, Choo K-K.R. An integrated conceptual digital forensic framework for cloud computing. Digital Investigation 2012, 9(2):71-80.
93. McClain F. Dropbox Forensics. Forensic Focus 2011, Accessed 10.02.13.
94. National Institute of Justice (NIJ). (2004). Forensic examination of digital evidence: A guide for law enforcement. Accessed 10.02.13. .
95. National Institute of Justice (NIJ). (2008). Electronic crime scene investigation: A guide for first responders, (2nd ed.). Accessed 10.02.13. .
96. MagnetSoftware. (2013). 'IEF Triage', viewed 10 February 2013, Accessed 10.02.13. .
97. Quick D., Choo K-K.R. Digital droplets: Microsoft SkyDrive forensic data remnants. Future Generation Computer Systems 2013, 29(6):1378-1394.
98. Quick D., Choo K-K.R. Dropbox analysis: Data remnants on user machines. Digital Investigation 2013, 10(1):3-18.
99. Russinovich, M., & Cogswell, B. (2012). Microsoft sysinternals process monitor, viewed 23 January 2013, Accessed 10.02.13. .
100. USDoD. (1995). Dod 5220.22-M-Sup 1, National industrial security program operating manual supplement. Accessed 10.02.13. .
101. Zatyko, K., & Bay, J. (2012). The digital forensics cyber exchange principle. Forensic Magazine. December 2011 - January 2012, pp. 13-15.
102. Association of Chief Police Officers (ACPO). (2006). Good practice guidelines for computer based evidence v4.0. Accessed 02.10.12. .
103. Chung, H., Park, J., Lee, S., & Kang, C. (2012). Digital forensic investigation of cloud storage services, digital investigation. Accessed 02.10.12. .
104. Duffy, A. (2010). 'Faraday bag testing in a reverberation chamber - a preliminary study'. Accessed 02.10.12. .
105. Kleynhans, S. (2012). The new PC Era- the personal cloud. Gartner Inc. Accessed 02.10.12. .
106. McClain F. Dropbox Forensics. Forensic Focus 2011, Accessed 02.10.12.
107. Microsoft. (2008). How NTFS reserves space for its master file table (MFT). Accessed 02.10.12. .
108. Microsoft. (2012a). Shortcuts: frequently asked questions. Accessed 02.10.12. .
109. Microsoft. (2012b). What is the prefetch folder? Accessed 02.10.12. .
110. Mueller, L. (2010). Windows 7 Forensics - Part IV - Thumbcache_*.db. Accessed 02.10.12. .
111. National Institute of Justice (NIJ). (2004), Forensic examination of digital evidence: A guide for law enforcement. Accessed 02.10.12. .
112. National Institute of Justice (NIJ). (2008), Electronic crime scene investigation: A guide for first responders, 2nd ed. Accessed 02.10.12. .
113. Office of Law Enforcement Standards of the National Institute of Standards and Technology (NIST). (2012). NIST computer forensic tool testing. Accessed 02.10.12. .
114. Quick D., Choo K. Digital droplets: microsoft SkyDrive forensic data remnants. Future Generation Computer Systems 2013, 29(6):1378-1394.
115. Quick D., Choo K. Dropbox analysis: data remnants on user machines. Digital Investigation 2013, 10(1):3-18.
116. Quick D., Choo K. Google drive: forensic analysis of data remnants. Journal of Network and Computer Applications 2013, In press.
117. Subashini S., Kavitha V. A survey on security issues in service delivery models of cloud computing. Journal of Network and Computer Applications 2011, 34(1):1-11. ISSN 1084-8045, doi:10.1016/j.jnca.2010.07.006.
118. W3Counter. (2012). Browser statistics July 2012. Accessed 02.10.12. .
119. AARNET. (2013). CloudStor+. Retrieved 10 April 2013, from . .
120. Australian Government Attorney-General's Department. (2013). Australian Government Policy and Risk management guidelines for the storage and processing of Australian Government information in outsourced or offshore ICT arrangements, from . .
121. Australian Government Department of Broadband, Communications and the Digital Economy. (2013). The national cloud computing strategy, from . .
122. Australian Government Parliamentary Joint Committee on Intelligence and Security. (2012). Proof committee hansard (Public) Wednesday, 5 September 2012, from . .
123. Badger L., Grance T., Patt-Corner R., Voas J. Cloud Computing Synopsis and Recommendations. (SP 800-146) 2012, U.S. Department of Commerce, Gaithersburg, MD.
124. Cuthbertson S. Mutual assistance in criminal matters: Cyberworld realities. Cross-border law enforcement regional law enforcement cooperation - european, australian and asia-pacific perspective 2012, 127-142. Routledge Research in Transnational Crime and Criminal Law. S. Hufnagel, C. Harfield, S. Bronitt (Eds.).
125. European Network and Information Security Agency (ENISA). (2012). Procure Secure: A guide to Monitoring of Security Service Levels in Cloud Contracts. Heraklion, Greece. European Network and Information Security Agency.
126. Google. (2013). Google trends - web search interest: owncloud - worldwide, 2004 - present. Retrieved 12 July 2013, from . .
127. Hooper C., Martini B., Choo K.-K.R. Cloud computing and its implications for cybercrime investigations in Australia. Computer Law & Security Review 2013, 29(2):152-163. doi: .
128. Jenkins, R. J. (1997). Hash functions for hash table lookup. Retrieved 22 August 2013, from . .
129. Junod, P. (2012). OwnCloud 4.0 and Encryption. Retrieved 24 September 2012, from . .
130. Klosowski, T. (2013). How to set up your own private cloud storage service with OwnCloud. Retrieved 5 April 2013, from . .
131. Martini B., Choo K.-K.R. An integrated conceptual digital forensic framework for cloud computing. Digital Investigation 2012, 9(2):71-80.
132. Martini B., Choo K-K.R. Cloud storage forensics: ownCloud as a case study. Digital Investigation 2013, In press. doi: http://dx.doi.org/10.1016/j.diin.2013.08.005].
133. McKemmish R. What is forensic computing?. Trends and Issues in Crime and Criminal Justice 1999, 118:1-6.
134. Microsoft. (2013). Monitored file name extensions (Windows). Retrieved 15 July 2013, from . .
135. ownCloud. (2013). Sync Clients | ownCloud.org. Retrieved 12 July 2013, from . .
136. Tassone C, Martini B., Choo K-K.R., Slay J. Mobile device forensics: A snapshot. Trends & Issues in Crime and Criminal Justice 2013, 460:1-7.
137. United Nations Office on Drugs and Crime (UNODC) The use of the Internet for terrorist purposes 2012, United Nations, New York, US.
138. United States National Institute of Justice (US NIJ) Forensic examination of digital evidence: a guide for law enforcement 2004, U.S. Department of Justice, Washington, DC.
139. ACPO. (2006). Good practice guidelines for computer based evidence v4.0, Available from . .
140. Chung, H., Park, J., Lee, S., & Kang, C. (2012). Digital forensic investigation of cloud storage services, from . .
141. Clarke, S. (2013, 28 January 2013). What are 'gdocs'? Google Drive Data Retrieved February 16, 2013, Available from . .
142. Dropbox. (2012). Contact web page-legal enquiries, Available from . https://www.dropbox.com/contact/.
143. DropBox. (2013a). Privacy policy Retrieved 17 February 2013, Available from . https://www.dropbox.com/dmca#privacy.
144. DropBox. (2013b). Security overview Retrieved 17 February 2013, Available from . https://www.dropbox.com/dmca#security.
145. DropBox. (2013c). Terms of service Retrieved 17 February 2013, Available from . https://www.dropbox.com/dmca#terms.
146. Dykstra J., Sherman A. Acquiring forensic evidence from infrastructure-as-a-service cloud computing: Exploring and evaluating tools, trust, and techniques. Digital Investigation 2012.
147. Google. (2012). Official blog, June 29, 2012 Retrieved 17 February 2013, Available from . .
148. Google. (2013). Legal process, Retrieved 3 February 2013, Available from . .
149. Klimt, B., & Yang, Y. (2004). Introducing the Enron corpus. In Paper presented at the First conference on email and anti-spam (CEAS).
150. Malik, O. (2012). How big is Dropbox? Hint: very big Retrieved 17 February 2013, Available from . .
151. Martini B., Choo K.-K.R. Cloud storage forensics: ownCloud as a case study. Digital Investigation 2013, In press. DOI: http://dx.doi.org/10.1016/j.diin.2013.08.005].
152. McClain, F. (2011, 31 May 2011). Dropbox forensics, Available from . .
153. McClain, F. (2012). Exfiltration forensics in the age of the cloud, Retrieved 2 February 2013, Available from . .
154. McKemmish R. What is forensic computing?. Trends and Issues in Crime and Criminal Justice, Australian Institute of Criminology 1999, 118:1-6.
155. Microsoft. (2013). Services agreement, Retrieved 17 February 2013, Available from . .
156. NIJ. (2004). Forensic examination of digital evidence: A guide for law enforcement, Available from . .
157. NIJ. (2008). Electronic crime scene investigation: A guide for first responders (2nd ed.), Available from . .
158. Quick D., Choo K. Digital droplets: Microsoft SkyDrive forensic data remnants. Future Generation Computer Systems 2013, 29(6):1378-1394.
159. Quick D., Choo K. Dropbox analysis: Data remnants on user machines. Digital Investigation 2013, 10(1):3-18.
160. Quick D. & Choo K.-K. R. (2013c). Forensic collection of cloud storage data:does the act of collection result in changes to the data or its metadata? Digital Investigation, 10(3), 266-277.
161. Quick D., Choo K.-K.R. Google drive: Forensic analysis of data remnants. Journal of Network and Computer Applications 2013, In press.
162. Roach, M. (2012, 23 August 2012). Cumulus data launches cloud collection service, Available from . .
163. Rosenberg, A. (2011). Dropbox popularity explodes in 2011, now serves 25 million users, Retrieved 17 February 2013, Available from . .
164. Ruan K., Carthy J., Kechadi T., Crosbie M. Cloud forensics. Advances in Digital Forensics VII 2011, 35-46.
165. SAI HB 171-2003 Guidelines for the management of IT evidence 2003, Standards Australia, Sydney, Australia.
166. Sinofsky, S. (2012). Windows 8 launch, retrieved 25 January 2013, Available from . .
167. United States Department of State. (2013). International Narcotics Control Strategy Report (Volume II: Money Laundering and Financial Crimes), Available from . .