Due to the flexibility, affordability and portability of cloud storage, individuals and companies envisage the cloud storage as one of the preferred storage media nowadays. This attracts the eyes of cyber criminals, since much valuable informa- tion such as user credentials, and private customer records are stored in the cloud. There are many ways for criminals to compromise cloud services; ranging from non-technical attack methods, such as social engineering, to deploying advanced malwares. Therefore, it is vital for cyber forensics examiners to be equipped and informed about best methods for investigation of different cloud platforms. In this chapter, using pCloud (an extensively used online cloud storage service) as a case study, and we elaborate on different kinds of artefacts retrievable during a forensics examination. We carried out our experiments on four different virtual machines running four popular operating systems: a 64 bit Windows 8, Ubuntu 14.04.1 LTS, Android 4.4.2, and iOS 8.1. Moreover, we examined cloud remnants of two different web browsers: Internet Explorer and Google Chrome on Windows. We believe that our study would promote awareness among digital forensic examiners on how to conduct cloud storage forensics examination.
Along the same line of study, Hale @cite_20 analyzed the digital artefacts remnant on a computer after accessing or manipulating Cloud Drive. They could recover several information, such as installation path, and upload download operations. @cite_31 , presented new method in order to analyze the digital artefacts left on all accessible devices, such as Mobile phones (e.g., iPhone and Android smartphone) and Desktop systems, running different OS (e.g., Windows and Mac) while using Amazon S3, Google Docs, Dropbox, and Evernote. Contrary to most of the cloud storage services that are based on open source platforms, Apple users, have their own special cloud storage called . Oestreicher @cite_62 investigated particularly iCloud service in order to find leftover digital droplets when using native Mac OS X during system synchronization with the cloud. There are also various research studies on several different cloud storage services that we summarized in Table . We refer the interested reader to @cite_63 @cite_25 for a comprehensive survey in this regard.
@cite_62 @cite_63 @cite_31 @cite_25 @cite_20
2039687910 2034493311 1991458033 2040656613
The acquisition of data stored on cloud services has become increasingly important to digital forensic investigations. Apple, Inc. continues to expand the capabilities of its cloud service, iCloud. As such, it is critical to determine an effective means for forensic acquisition of data from this service and its effect on the original file data and metadata.This research examined files acquired from the iCloud service via the native Mac OS X system synchronization with the service. The goal was to determine the operating system locations of iCloud-synched files. Once located, the secondary goal was to determine if the file hash values match those of the original files and whether file metadata, particularly timestamps, are altered. As cloud computing becomes more prevalent, there is a growing need for forensic investigations involving cloud technologies. The field of cloud forensics seeks to address the challenges to digital forensics presented by cloud technologies. This article reviews current research in the field of cloud forensics, with a focus on "forensics in the cloud"--that is, cloud computing as an evidence source for forensic investigations. Abstract The demand for cloud computing is increasing because of the popularity of digital devices and the wide use of the Internet. Among cloud computing services, most consumers use cloud storage services that provide mass storage. This is because these services give them various additional functions as well as storage. It is easy to access cloud storage services using smartphones. With increasing utilization, it is possible for malicious users to abuse cloud storage services. Therefore, a study on digital forensic investigation of cloud storage services is necessary. This paper proposes new procedure for investigating and analyzing the artifacts of all accessible devices, such as Windows system, Mac system, iPhone, and Android smartphone. Cloud storage is becoming increasingly popular among individuals and businesses. Amazon Cloud Drive is a flavor of cloud-based storage that allows users to transfer files to and from multiple computers, with or without the use of a separate application that must be installed on the user's machine. This paper discusses the digital artifacts left behind after an Amazon Cloud Drive has been accessed or manipulated from a computer. Methods available to a forensic examiner that can be used to determine file transfers that occurred to and from an Amazon Cloud Drive on a computer, as well as retrieving relevant Cloud Drive artifacts from unallocated space is discussed in this paper. Two Perl scripts are also introduced to help automate the process of retrieving information from Amazon Cloud Drive artifacts.