NCJ Number
240131
Date Published
2011
Length
38 pages
Annotation
This paper discusses the idea of cloud computing and examines the challenges that face forensic investigators in digital forensic investigations.
Abstract
This paper begins with a discussion on cloud computing which is defined as replacing traditional information technology (IT) hardware found in an organization's data center with virtualized, remote, on-demand software services that have been configured for the specific needs of the organization. This poses a problem for traditional digital forensic investigations because the software and data for the organization may be managed not by the organization, but by third part providers, and it may be physically stored across many different geographic locations. The paper discusses in detail how digital forensic investigations should occur in the United Kingdom, providing a framework, the Digital Investigation Process (DIP) Model, for investigators to follow to ensure a complete investigation. The paper discusses the different parts of DIP that include Identification, Preservation and Collection, Storage Capacity, Chain of Custody, Digital Image Acquisition, Deleted Data, Cross Organizational Cooperation, Examination and Analysis, Types of Evidence in Clouds, Validation using Hashing Tools, and Presentation. The paper also includes a section on other research that has investigated the challenges of cloud computing for digital forensic investigators, as well as information on future work that needs to be done to understand the full impact of cloud computing on digital forensics. Table and references