Contemporary Digital Forensic Investigations of Cloud and Mobile Applications

Kim-Kwang Raymond Choo, Ali Dehghantanha

• Publisher: Syngress
• Year: 2016
• ISBN:
  9780128054482
• Topic: Computer Science
• Subtopic: Systems Architecture
• Index: Computer Science

Contemporary Digital Forensic Investigations of Cloud and Mobile Applications comprehensively discusses the implications of cloud (storage) services and mobile applications on digital forensic investigations. The book provides both digital forensic practitioners and researchers with an up-to-date and advanced knowledge of collecting and preserving electronic evidence from different types of cloud services, such as digital remnants of cloud applications accessed through mobile devices.

This is the first book that covers the investigation of a wide range of cloud services. Dr. Kim-Kwang Raymond Choo and Dr. Ali Dehghantanha are leading researchers in cloud and mobile security and forensics, having organized research, led research, and been published widely in the field. Users will gain a deep overview of seminal research in the field while also identifying prospective future research topics and open challenges.

• Presents the most current, leading edge research on cloud and mobile application forensics, featuring a panel of top experts in the field
• Introduces the first book to provide an in-depth overview of the issues surrounding digital forensic investigations in cloud and associated mobile apps
• Covers key technical topics and provides readers with a complete understanding of the most current research findings
• Includes discussions on future research directions and challenges

Chapter 1

Contemporary Digital Forensics Investigations of Cloud and Mobile Applications

K.-K.R. Choo*^,†; A. Dehghantanha^{‡ *} University of Texas at San Antonio, San Antonio, TX, United States
^† University of South Australia, Adelaide, SA, Australia
^‡ University of Salford, Salford, United Kingdom

Abstract

Digital forensics is a relatively new and fast growing field of research that is focused on the development of forensically sound methods for the collection, preservation, and analysis of digital evidence. However, the fast pace of development in IT and digital technologies has made it difficult for the forensic research community to react in a timely manner and develop tools, techniques, and procedures for handling digital evidence. The wide adoption of cloud platforms and mobile devices has made them an important resource for digital forensics. The identification, collection, preservation, and analysis of evidence from mobile and cloud platforms has proven to be a challenge. This chapter provides an overview of the existing research gaps in the cloud and mobile forensic fields.

Keywords

Digital investigation; Cyber forensics; Mobile forensics; Cloud forensics; Instant messaging application forensics

The US government defined cyberspace as “the interdependent network of information technology infrastructures that includes the Internet, telecommunications networks, computer systems, embedded processors, and controllers in critical industries” [1]. The increasing number and role of cyber elements in both civil and military infrastructures and applications have attracted the attention of cybercriminals (including state-sponsored actors) [2]. As observed by Choo, Smith, and McCusker, there are a number of attack vectors, ranging from syntactic—exploiting technical vulnerabilities (e.g., use of malware [3])—to semantic—exploiting social vulnerabilities to blended approaches compromising both social and technical exploitations [4].

Cybercrime can be loosely defined as an unlawful activity involving computers, as the subject, object, or tools of a crime [5]. Increasingly popularity has also resulted in the importance of digital forensics (also known as cyber forensics, computer forensics and network forensics) [6,7]. While there are a number of definitions for digital forensics, it can be broadly defined to be the identification, collection, preservation, analysis, and reporting of digital evidences [8]. While conducting a forensic investigation, it is important to ensure that one is familiar with the local and relevant laws and regulations for handling digital evidence [9–11], data privacy regulation [12–16], and the relevant technical guidelines (e.g., guidelines for computer forensics [8,17–19], Internet forensics [20], and mobile forensics [10,21–25]), as well as maintaining up-to-date technical proficiency in investigating a broad range of attacks [26], malware [3,27–29], and popular consumer technologies such as cloud [11,20,30] and internet of things [31,32].

Any new consumer technology created and deployed will at some point come under scrutiny in the course of an investigation, criminal or civil. Cloud computing, for example, has seen massive growth in recent years. Although cloud computing are often being credited for enabling promising and cost-competitive solutions, it is subject to potential abuse. Identification, collection, preservation, and analysis of evidence in a cloud environment can be “cloudy” [33,34], as data of interest are likely stored in a cloud server outside the jurisdiction of the investigators. Mobile devices are, however, a potential evidential source as such devices are commonly used to access cloud services. Thus, it is not surprising that cloud and mobile forensics are emerging as popular forensic research focuses [2,35,36].

The first (and one of the most widely cited) cloud forensic framework(s) was proposed by Martini and Choo [20,37], which was derived from the McKemmish investigation framework [38] and the NIST mobile forensics guideline [39]. This framework had been used in a number of cloud forensic studies investigating ownCloud [20], Amazon EC2 [40], XtreemFS [41], SkyDrive [42], Dropbox [43], Google Drive [44–47], SugarSync [48], MEGA [49], hubiC [50], and Ubuntu One [51]. Chung et al. [52] proposed another methodology for cloud forensics and utilized it to investigate Amazon S3, Google Docs, and Evernote. Other studies have demonstrated that it is possible to partially retrieve residual evidences of cloud platforms such as synchronizing history and synchronized files from unstructured datasets [53]. Developing tools and techniques to acquire evidence from different cloud platforms [54–57] analyzing the effectiveness of data acquisition functions of existing cloud forensics tools [58,59] are also topics of ongoing research interest. A number of researchers have also pointed out potential complications in preserving cloud data remnants [45,60].

Cloud computing is not the only consumer technology of forensic importance [20,43,44,49–51,55,61–66]. Instant messaging mobile applications such as American Online Messenger [67–69], MSN Messenger [67,70], Yahoo Messenger [71,72], Facebook Messenger [19,73], Skype [74–76] and even Trillian [77], and Pidgin [78] have been the subject of forensic examinations. In addition to mobile (and cloud) app forensics, a number of researchers have also focused on mobile device forensics, such as Blackberry [79,80], Nokia [81,82], and Samsung [83].

Suffice it to say that the need for digital forensics is unlikely to fade away in the foreseeable future, and in fact with the increasing digitalization of our society, the importance of digital forensics will be more important than ever.

This book seeks to provide both digital forensic practitioners and researchers an up-to-date and advanced knowledge in collecting, preserving, and analyzing digital evidence from different cloud services such as platform as a service, infrastructure as a service, and storage as a service.

The structure of the remaining of this book is as follows.

Chapter 2: Forensics Analysis of Skype, Viber, and WhatsApp on Android Platform

Chapter 3: Investigating America Online Instant Messaging Application: Data Remnants on Windows 8.1 Client Machine

Chapter 4: Forensic Investigation of Social Media and Instant Messaging Services in Firefox OS: Facebook, Twitter, Google +, Telegram, OpenWapp, and Line as Case Studies

Chapter 5: Network Traffic Forensics on Firefox Mobile OS: Facebook, Twitter, and Telegram as Case Studies

Chapter 6: Mobile Phone Forensics: An Investigative Framework Based on User Im...

Table of contents

• Cover image
• Title page
• Table of Contents
• Copyright
• Contributors
• About the Editors
• Chapter 1: Contemporary Digital Forensics Investigations of Cloud and Mobile Applications
• Chapter 2: Forensics Analysis of Android Mobile VoIP Apps
• Chapter 3: Investigating America Online Instant Messaging Application: Data Remnants on Windows 8.1 Client Machine
• Chapter 4: Forensic Investigation of Social Media and Instant Messaging Services in Firefox OS: Facebook, Twitter, Google+, Telegram, OpenWapp, and Line as Case Studies
• Chapter 5: Network Traffic Forensics on Firefox Mobile OS: Facebook, Twitter, and Telegram as Case Studies
• Chapter 6: Mobile Phone Forensics: An Investigative Framework Based on User Impulsivity and Secure Collaboration Errors
• Chapter 7: Performance of Android Forensics Data Recovery Tools
• Chapter 8: Honeypots for Employee Information Security Awareness and Education Training: A Conceptual EASY Training Model
• Chapter 9: Implications of Emerging Technologies to Incident Handling and Digital Forensic Strategies: A Routine Activity Theory
• Chapter 10: Forensic Readiness: A Case Study on Digital CCTV Systems Antiforensics
• Chapter 11: Forensic Visualization: Survey and Future Research Directions
• Chapter 12: Investigating Storage as a Service Cloud Platform: pCloud as a Case Study
• Chapter 13: Cloud Storage Forensics: Analysis of Data Remnants on SpiderOak, JustCloud, and pCloud
• Chapter 14: Residual Cloud Forensics: CloudMe and 360Yunpan as Case Studies
• Chapter 15: An Android Cloud Storage Apps Forensic Taxonomy
• Index