Forensics Investigation System for Cloud Storage based on Provenance Scheme

Abstract

Cloud storage forensics has recently emerged as a salient area of inquiry. One area of difficulty is the identification and acquisition of potential data when disparate services can be utilized by criminals. There is a need for a sound digital forensic framework relating to the forensic analysis of client devices to identify potential data holdings. This paper proposes a forensic investigation framework for cloud storage environment. In the proposed system, the evidences are created and collected according to the cloud user’s actions using digital provenance scheme. However, provenance information cannot be trusted unless its integrity is assured. So, the cryptographic algorithms are used to be the reliable and trusted provenances (evidences) at preservation phase and used to verify the evidence at examination phase. By using this scheme, the proposed system is faster than traditional investigation system for the forensics purpose. It also helps forensic examiners to examine sensitive file from the cloud storages.