Digital Forensic Architecture for Cloud Computing Systems: Methods of Evidence Identification, Segregation, Collection and Partial Analysis

Abstract

Various advantages offered by cloud computing business model has made it one of the most significant of current computing trends like personal, mobile, ubiquitous, cluster, grid, and utility computing models. These advantages have created complex issues for forensic investigators and practitioners for conducting digital forensic investigation in cloud computing environment. In the past few years, many researchers have contributed in identifying the forensic challenges, designing forensic frameworks, data acquisition methods for cloud computing systems. However, to date, there is no unique universally accepted forensic process model for cloud computing environment to acquire and analyze data available therein. This paper contributes in three specific areas to expedite research in this emerging field. First is designing a digital forensic architecture for cloud computing systems; second is evidence source identification, segregation and acquisition; and finally methods for partial analysis of evidence within and outside of a virtual machine (VM).