The most popular and comprehensive Open Source ECM platform
Let us know more
Cloud Forensics: Cloud Computing Challenges
A report by the National Institute of Standards and Technology (NIST) recently identified 65 different issues that are tripping up or blocking forensic analysts from doing their job when data and applications are located in the cloud.
Some of the challenges are specifically technical ones, like the use of metadata or the way in which deleted data is overwritten. Legal issues exist too, like the difficulty in obtaining subpoenas to access data that is stored in physical locations outside the jurisdictions of the investigation.
Ellen Messmer, editor at Network World, asked the question “Any business that anticipates using cloud-based services should be asking the question: What can my cloud provider do for me in terms of providing digital forensics data in the event of any legal dispute, civil or criminal case, cyberattack or data breach?”
Martin Herman, senior adviser for forensics and IT at the National Institute of Standards and Technology, echoes that question saying “the question arises as cloud computing becomes more popular, how do you do forensics for information that’s in the cloud? If a criminal uses a laptop and might have files that implicate him, he deletes those files. There are various forensic tools that could be used to recover those. But in a cloud situation, because there’s a shared virtual environment, it’s more likely that another user will actually write over those portions of files marked as deleted.”
One major problem for forensic examiners cited by the NIST report is the location of the servers used by cloud applications. Herman said that “If someone’s data was sitting in the European Union, how does U.S. law enforcement get access to it or vice versa? They can’t just go in and seize the computer as often is done in traditional forensics.”
Herman said that “many of the traditional approaches are going to be more difficult to apply, and in some cases they won’t work in the cloud… The long-term goal is to build a deeper understanding of, and consensus on, the high-priority challenges so that the public and private sectors can collaborate on effective responses.”
