Cloud forensics-Tool development studies & future outlook

In this work, we describe our experiences in developing cloud forensics tools and use them to support three main points: First, we make the argument that cloud forensics is a qualitatively different problem. In the context of SaaS, it is incompatible with long-established acquisition and analysis techniques, and requires a new approach and forensic toolset. We show that client-side techniques, which are an extension of methods used over the last three decades, have inherent limitations that can only be overcome by working directly with the interfaces provided by cloud service providers. Second, we present our results in building forensic tools in the form of three case studies: kumoddea tool for cloud drive acquisition, kumodocsea tool for Google Docs acquisition and analysis, and kumofsea tool for remote preview and screening of cloud drive data. We show that these tools, which work with the public and private APIs of the respective services, provide new capabilities that cannot be achieved by examining client-side