A Digital Forensic Process Model for Cloud Computing

Abstract

Existing digital forensic frameworks do not address issues relevant to cloud environment where multiple users could be generating events that may coalesce to or independently and in parallel result in a security incident. In this paper a forensic process model is proposed which considers possibility of multiple parallel event sequences that must be considered to achieve correctness in event reconstruction in digital forensic investigation. Towards this end, use of Event Sequence Graph (ESG) as a directed graph for outlining events and the sequences which they follow has been proposed by the authors. Two case studies of attack from multiple sources have been used as examples to explain the type of scenarios which could be easily understood using an ESG.