Analysis of Cloud Digital Evidence

Cloud forensics analyzes digital evidence obtained from cloud computing environments. In the cloud, the traditional forensic focus of acquiring and analyzing snapshots of digital artifacts will becomes significantly less relevant as many of the artifacts are ephemeral, while the history of state changes become pervasive. This, over the medium-to-long term, the task of forensically reconstructing prior events will become easier over time as a growing fraction of the relevant information will be explicitly recorded. However, in the short term, the shift to cloud computing necessitates a paradigm change for forensic acquisition and processing tools from primarily artifact-centric to primarily log-centric. As the discussion will show, existing tools are ill-equipped to deal with the situation and we urgently need a new generation of cloud-focused forensic tools.