Cloud storage forensics: MEGA as a case study

Australian Journal of Forensic Sciences

Volumn 49, Issue 3, 2017, Pages 344-357

  Daryabar, Farid ^a   Dehghantanha, Ali ^b   Choo, Kim Kwang Raymond ^c  

^a UNIVERSITY PUTRA MALAYSIA   (Malaysia)

^b UNIVERSITY OF SALFORD   (United Kingdom)

^c UNIVERSITY OF SOUTH AUSTRALIA   (Australia)

Author keywords

Android forensics; cloud forensics; cloud storage application forensics; iOS forensics

Indexed keywords

ARTICLE; ARTIFACT; CASE STUDY; CLOUD COMPUTING; DATA ANALYSIS; DATA BASE; FORENSIC SCIENCE; INFORMATION PROCESSING; METHODOLOGY; MOBILE APPLICATION; PROCESS MODEL;

EID: 84963876744     PISSN: 00450618     EISSN: 1834562X     Source Type: Journal    
DOI: 10.1080/00450618.2016.1153714     Document Type: Article

References (52)

1. Martini B, Choo K-KR. An integrated conceptual digital forensic framework for cloud computing. Digit Investig. 2012;9:71–80.10.1016/j.diin.2012.07.001
2. Quick, D, Martini, B, Choo, R. Cloud storage forensics. Boston:Syngress, an Imprint of Elsevier; 2014.
3. Shaerpour, K, Dehghantanha, A, Mahmod, R. Trends in android malware detection. J Digit Forensics Secur Law. 2013;8:21–40.
4. Mohtasebi, SH, Dehghantanha A, Towards a unified forensic investigation framework of smartphones. Int J Comput Theory Eng. 2013;5:351–355. 10.7763/IJCTE.2013.V5.708
5. Aminnezhad A, Dehghantanha A, Abdullah MT, Damshenas M. Cloud forensics issues and opportunities. Int J Inf Process Manag. 2013;4:76–85.
6. Damshenas, M, Dehghantanha, A, Mahmoud, R, Bin Shamsuddin, S, Forensics investigation challenges in cloud computing environments. In Proceedings title:2012 international conference on cyber security, cyber warfare and digital forensic (CyberSec). Kuala Lumpur, Malaysia:IEEE; 2012, 190–194. doi:10.1109/CyberSec.2012.6246092
7. Damshenas, M, Dehghantanha, A, Mahmoud, R, Shamsuddin, S. Cloud computing and conflicts with digital forensic investigation. Int J Digit Content Technol its Appl. 2013;7:543–554.
8. Dehghantanha, A, Franke, K, Privacy-respecting digital investigation. In 2014 Twelfth Annual International Conference on Privacy, Security and Trust. Toronto:IEEE; 2014, 129–138. doi:10.1109/PST.2014.6890932
9. Aminnezhad, A, Ali Dehghantanha, MTA. A survey on privacy issues in digital forensics. Int J Cyber-Security Digit Forensics. 2012;1:311–323.
10. Daryabar F, Dehghantanha A, Udzir NI, Fazlida N. A survey on privacy impacts of digital investigation. J Next Gen Inf Tech. 2013;4:57–68.
11. Dehghantanha, A, Mahmod, R. UPM:user-centered privacy model in pervasive computing systems. Proc. - 2009 Int. Conf. Futur. Comput. Commun. ICFCC 2009. 2009;9, 65–70.10.1109/ICFCC.2009.50
12. Damshenas M, Dehghantanha A, Mahmoud R. A Survey on Malware propagation, analysis and detection. Int J Cyber-Security Digit Forensics. 2013;2:10–29.
13. Daryabar, F, Dehghantanha, A, Udzir, NI, Investigation of bypassing malware defences and malware detections. In 2011 7th International Conference on Information Assurance and Security (IAS). Melaka, Malaysia:IEEE; 2011, 173–178. doi:10.1109/ISIAS.2011.6122815
14. Martini B, Do Q, Choo K-KR. Conceptual evidence collection and analysis methodology for android devices. Cloud Secur Ecosyst. 2015;285–307:doi:10.1016/B978-0-12-801595-7.00014-8.
15. Martini, B, Do, Q, Choo, K-KR, Chapter 15 - mobile cloud forensics:an analysis of seven popular android apps. Cloud Secur Ecosyst. 2015;309–345. doi:http://dx.doi.org/10.1016/B978-0-12-801595-7.00015-X10.1016/B978-0-12-801595-7.00015-X
16. Norouzi, F, Dehghantanha, A, Eterovic-Soric, B, Choo, K-KR. Investigating social networking applications on smartphones:detecting Facebook, twitter, LinkedIn, and Google+ artifacts on Android and iOS platforms. Aust J Forensics Sci. 2015. [In press].
17. Shariati M, Dehghantanha A, Choo K-KR. SugarSync forensic analysis. Aust J Forensic Sci. 2015;48:95–117.
18. Shariati, M, Dehghantanha, A, Martini, B, Choo, K-KR. The cloud security ecosystem. Boston:Syngress; 2015. Chapter 19 - Ubuntu One investigation:Detecting evidences on client machines (ed. Choo RK-KR,); 429–446.
19. Aminnezhad A, Dehghantanha A, Abdullah MT, Damshenas M. Cloud forensics issues and opportunities. Int J Inf Process Manag. 2013;4:76–85.
20. Damshenas, M, Dehghantanha, A, Mahmoud, R, bin Shamsuddin, S. Cloud computing and conflicts with digital forensic investigation. Int J Digit Content Technol its Appl. 2013;7:543.
21. Norouzizadeh Dezfouli F, Dehghantanha, A, Eterovic-Soric, B, Choo, K.-K. R. Investigating social networking applications on smartphones detecting Facebook, twitter, LinkedIn and Google+ artefacts on Android and iOS platforms. Aust J Forensic Sci. 2015;1–20:doi:10.1080/00450618.2015.1066854.
22. Yusoff, M, Mahmod, R, Dehghantanha, A, Abdullah, M, Advances of mobile forensic procedures in Firefox OS. International Journal of Cyber-Security and Digital Forensics (IJCSDF). 2014. Available from:http://usir.salford.ac.uk/33890/1/advances-of-mobile-forensic-procedures-in-firefox-os.pdf
23. Mohtasebi, S, Ali Dehghantanha, HGB, Smartphone forensics:a case study with Nokia e5-00 mobile phone. Int J Digit Inf Wirel. Commun. 2011;1:651–655.
24. Daryabar, F, Dehghantanha, A, Udzir, NI, Bin Shamsuddin, S, Towards secure model for SCADA systems. In Proceedings Title:2012 International Conference on Cyber Security, Cyber Warfare and Digital Forensic (CyberSec). Kuala Lumpur, Malaysia:IEEE; 2012, 60–64. doi:10.1109/CyberSec.2012.6246111
25. Ganji M, Dehghantanha A, Izuraudzir N, Damshenas M. Cyber warfare trends and future. Adv. Inf. Sci. Serv. Sci. 2013;5:1–10.
26. Imgraben J, Engelbrecht A, Choo K-KR. Always connected, but are smart mobile users getting more security savvy? A survey of smart mobile device users. Behav Inf Technol. 2014;33:1347–1360.10.1080/0144929X.2014.934286
27. Yusoff M, Mahmod R, Dehghantanha A, Abdullah M. Advances of mobile forensic procedures in Firefox OS. Int J Cyber-Security Digit. Forensics. 2014;3:183–199.
28. Yusoff MN, Mahmod, R, Abullah MT, Dehghantanha A. Performance measurement for mobile forensic data acquisition in Firefox OS. Int J Cyber-Security Digit Forensics. 2014;3:130–140.
29. Ibrahim, M, Dehghantanha, A, Modelling based approach for reconstructing evidence of VoIP malicious attacks. International Journal of Cyber-Security and Digital Forensics (IJCSDF). 2014. Available from:http://usir.salford.ac.uk/34015/1/modelling.pdf
30. Dezfoli, FN, Ali Dehghantanha, RMNFBMSFD, Digital forensic trends and future. Int J Cyber-Security Digit Forensics. 2013;2:48–76.
31. Quick D, Choo K-KR. Forensic collection of cloud storage data:does the act of collection result in changes to the data or its metadata? Digit. Investig. 2013;10:266–277.10.1016/j.diin.2013.07.001
32. Daryabar, F, Ali Dehghantanha, NIUNF, Binti MSS, Bin S, A review on impacts of cloud computing on digital forensics. Int. J. Cyber-Security Digit. Forensics. 2013;2:77–94.
33. Chung H, Park J, Lee S, Kang C. Digital forensic investigation of cloud storage services. Digit Investig. 2012;9:81–95.10.1016/j.diin.2012.05.015
34. Marturana, F, Me, G, Tacconi, S, A case study on digital forensics in the cloud. In 2012 International Conference on Cyber-Enabled Distributed Computing and Knowledge Discovery (CyberC). 2012; Louisville, KY, USA. 111–116. doi:10.1109/CyberC.2012.26
35. Dykstra J, Sherman AT. Acquiring forensic evidence from infrastructure-as-a-service cloud computing:exploring and evaluating tools, trust, and techniques. Digit Investig. 2012;9:S90–S98.10.1016/j.diin.2012.05.001
36. Hale JS. Amazon cloud drive forensic analysis. Digit Investig. 2013;10:259–265.10.1016/j.diin.2013.04.006
37. Grispos, G, Glisson, WB, Storer, T. Using smartphones as a proxy for forensic evidence contained in cloud storage services. In 2013 46th Hawaii International Conference on System Sciences. Wailea, HI, USA:IEEE; 2013, 4910–4919. doi:10.1109/HICSS.2013.592
38. Martini B, Choo K-KR. Cloud storage forensics:Owncloud as a case study. Digit Investig. 2013;10:287–299.10.1016/j.diin.2013.08.005
39. Martini B, Choo K-KR. Distributed filesystem forensics:xtreemfs as a case study. Digit Investig. 2014;11:295–313.10.1016/j.diin.2014.08.002
40. Quick D, Choo K-KR. Google drive:forensic analysis of data remnants. J Netw Comput Appl. 2014;40:179–193.10.1016/j.jnca.2013.09.016
41. Quick D, Choo K-KR. Digital droplets:Microsoft SkyDrive forensic data remnants. Futur Gener Comput Syst. 2013;29:1378–1394.10.1016/j.future.2013.02.001
42. Quick D, Choo K-KR. Dropbox analysis:data remnants on user machines. Digit Investig. 2013;10:3–18.10.1016/j.diin.2013.02.003
43. Oestreicher K. A forensically robust method for acquisition of iCloud data. Digit Investig. 2014;11:S106–S113.10.1016/j.diin.2014.05.006
44. Martini, B, Choo, K-KR. Remote programmatic vcloud forensics:a six-step collection process and a proof of concept. In 2014 IEEE 13th International Conference on Trust, Security and Privacy in Computing and Communications. Beijing, China:IEEE; 2014, 935–942. doi:10.1109/TrustCom.2014.124
45. Federici C. Cloud data imager:a unified answer to remote acquisition of cloud storage areas. Digit Investig. 2014;11:30–42.10.1016/j.diin.2014.02.002
46. Ryan Ko, RC. The cloud security ecosystem. 1st ed. Elsevier; 2015. Available from:http://store.elsevier.com/The-Cloud-Security-Ecosystem/Ryan-Ko/isbn-9780128015957/
47. Martini B, Choo K-KR. Cloud forensic technical challenges and solutions:a snapshot. IEEE Cloud Comput. 2014;1:20–25.10.1109/MCC.2014.69
48. Pichan A, Lazarescu M, Soh ST. Cloud forensics:technical challenges, solutions and comparative analysis. Digit Investig. 2015;13:38–57.10.1016/j.diin.2015.03.002
49. Grispos, G, Glisson, W, Storer, T. The cloud security ecosystem. Boston:Syngress; 2015. Recovering residual forensic data from smartphone interactions with cloud storage providers (eds. Ko R, Choo K-KR,); 347–382.
50. Marty, R, Cloud application logging for forensics. Proc 2011 ACM Symp. Appl Comput. - SAC ’11. 2011;178. doi:10.1145/1982185.1982226
51. Shariati, M, Dehghantanha, A, Martini, B, Choo, K-KR. The cloud security ecosystem. Boston:Syngress; 2015. Chapter 19 - Ubuntu One investigation:Detecting evidences on client machines (ed. Choo RK-KR,); 429–446.
52. EDRM File Format Data Set 1.0.1. [Cited 2015 Feb 1]. Available from:http://www.edrm.net/projects/dataset/data-set-files