Digital forensic process and model in the cloud

Cloud computing offers significant advantages to organisations through the provision of fast and flexible ICT hardware and software infrastructures, thus enabling organisations to focus on creating innovative business values for the services they provide. As the prevalence and usage of networked Cloud computer systems increases, logically the likelihood of these systems being used for criminal behaviour also increases. On the other hand, the field of digital forensics has grown rapidly over the last decade due to the rise of the internet and associated crimes; however, while the theory is well established, the practical application of the discipline is still new and developing. Law enforcement agencies can no longer rely on traditional forensic methods of data acquisition through device seizure to gather relevant evidence pertaining to an investigation. Using traditional digital forensic methods will lead to the loss of valuable evidential material if employed during investigations that involve Cloud based infrastructures. Consequently, cloud computing and its impact on digital forensics will continue to grow. In this chapter, we review traditional digital forensics methods and explain why these are inadequate for Cloud forensic investigations with particular focus on law enforcement. We then present digital forensic processes and models to acquiring data from Cloud environments. These processes and models aim to overcome the limitations of traditional digital forensics and the challenges Cloud computing presents for digital forensic practitioners. We also evaluate cloud forensic models with a case study.