Implications of Cloud Computing on Digital Forensics

Abstract

Cloud computing is a paradigm for computing
services that are delivered to users over the Internet. In cloud
computing, users rent rather than buy their computing resources.
Cloud computing likely represents the next stage in the evolution
of the Internet. But the cloud computing paradigm is still
developing, with numerous unknowns and many questions open
for research. One critical question that has not received much
attention is security. A significant subset is digital forensics—
that is, (1) the discovery of evidence remaining on a computer
after a security breach or attack and (2) the use of that evidence
to investigate the event and establish facts for use in legal
proceedings.
This paper discusses the impact that cloud computing
will have on digital forensics. From a forensic perspective,
cloud computing raises a number of concerns. Most immediate
is whether or not forensic practitioners will be able to analyze
the Cloud using existing techniques of digital forensics. During
a traditional forensic examination, files on the storage media are
examined along with the entire file system structure. But this may
not be a practical model for examinations in the Cloud, where
the computer is virtual, that is, where numerous heterogeneous
resources, often geographically distributed, are combined. Other
concerns include protecting evidence against contamination
and anticipating the legal issues that will be raised by the Cloud
paradigm, with its resources spread over diverse administrative
and geopolitical domains. Comprehensive security services to
protect not only the Cloud’s resources but also the data that
resides on them may need to be instituted. The open literature to
date has yet to address any of these challenges.
Cloud technologies are predicted to cause a paradigm shift
in digital forensic techniques. This paper discusses the application
of traditional digital forensic examinations to cloud forensics.