Keywords: BitTorrent Sync Peer-to-Peer Synchronisation Privacy Digital forensics abstract With professional and home Internet users becoming increasingly concerned with data protection and privacy, the privacy afforded by popular cloud file synchronisation services, such as Dropbox, OneDrive and Google Drive, is coming under scrutiny in the press. A number of these services have recently been reported as sharing information with governmental security agencies without warrants. BitTorrent Sync is seen as an alternative by many and has gathered over two million users by December 2013 (doubling since the previous month). The service is completely decentralised, offers much of the same syn- chronisation functionality of cloud powered services and utilises encryption for data transmission (and optionally for remote storage). The importance of understanding Bit- Torrent Sync and its resulting digital investigative implications for law enforcement and forensic investigators will be paramount to future investigations. This paper outlines the client application, its detected network traffic and identifies artefacts that may be of value as evidence for future digital investigations. a 2014 The Authors. Published by Elsevier Ltd on behalf of DFRWS. This is an open access article under the CC BY-NC-ND license (http: creativecommons.org licenses by-nc-nd 3.0 ).
Forensic investigation of these utilities can be challenging, as presented by in their 2012 paper @cite_11 . Unless local synchronisation is completely up to date, the full picture of the data may reside across temporary files, volatile storage (such as the system's RAM) and across multiple data-centres of the service provider's cloud storage facilities. Any digital forensic examination of these systems must pay particular attention to the method of access, e.g., usually the Internet browser connecting to the service provider's access page. This temporary access serves to highlight the importance of live forensic techniques when investigating a suspect machine. Cutting power to the suspect machine may not only lose access to any currently opened documents, but would also lose any currently stored passwords or other authentication tokens that are stored in RAM. describe three main forms of online storage in use by consumers:
@cite_11
2020315857 2039687910 2136331433 2093283549
The storage as a service (StaaS) cloud computing architecture is showing significant growth as users adopt the capability to store data in the cloud environment across a range of devices. Cloud (storage) forensics has recently emerged as a salient area of inquiry. Using a widely used open source cloud StaaS application - ownCloud - as a case study, we document a series of digital forensic experiments with the aim of providing forensic researchers and practitioners with an in-depth understanding of the artefacts required to undertake cloud storage forensics. Our experiments focus upon client and server artefacts, which are categories of potential evidential data specified before commencement of the experiments. A number of digital forensic artefacts are found as part of these experiments and are used to support the selection of artefact categories and provide a technical summary to practitioners of artefact types. Finally we provide some general guidelines for future forensic analysis on open source StaaS products and recommendations for future work. The acquisition of data stored on cloud services has become increasingly important to digital forensic investigations. Apple, Inc. continues to expand the capabilities of its cloud service, iCloud. As such, it is critical to determine an effective means for forensic acquisition of data from this service and its effect on the original file data and metadata.This research examined files acquired from the iCloud service via the native Mac OS X system synchronization with the service. The goal was to determine the operating system locations of iCloud-synched files. Once located, the secondary goal was to determine if the file hash values match those of the original files and whether file metadata, particularly timestamps, are altered. The increasing popularity of cryptography poses a great challenge in the field of digital forensics. Digital evidence protected by strong encryption may be impossible to decrypt without the correct key. We propose novel methods for cryptographic key identification and present a new proof of concept tool named Interrogate that searches through volatile memory and recovers cryptographic keys used by the ciphers AES, Serpent and Twofish. By using the tool in a virtual digital crime scene, we simulate and examine the different states of systems where well known and popular cryptosystems are installed. Our experiments show that the chances of uncovering cryptographic keys are high when the digital crime scene are in certain well-defined states. Finally, we argue that the consequence of this and other recent results regarding memory acquisition require that the current practices of digital forensics should be guided towards a more forensically sound way of handling live analysis in a digital crime scene. Keywords: BitTorrent Sync Peer-to-Peer Synchronisation Privacy Digital forensics abstract With professional and home Internet users becoming increasingly concerned with data protection and privacy, the privacy afforded by popular cloud file synchronisation services, such as Dropbox, OneDrive and Google Drive, is coming under scrutiny in the press. A number of these services have recently been reported as sharing information with governmental security agencies without warrants. BitTorrent Sync is seen as an alternative by many and has gathered over two million users by December 2013 (doubling since the previous month). The service is completely decentralised, offers much of the same syn- chronisation functionality of cloud powered services and utilises encryption for data transmission (and optionally for remote storage). The importance of understanding Bit- Torrent Sync and its resulting digital investigative implications for law enforcement and forensic investigators will be paramount to future investigations. This paper outlines the client application, its detected network traffic and identifies artefacts that may be of value as evidence for future digital investigations. a 2014 The Authors. Published by Elsevier Ltd on behalf of DFRWS. This is an open access article under the CC BY-NC-ND license (http: creativecommons.org licenses by-nc-nd 3.0 ).