{"id":2468,"date":"2021-07-03T23:01:00","date_gmt":"2021-07-03T23:01:00","guid":{"rendered":"http:\/\/ismiletechnologies.com\/?p=2468"},"modified":"2021-10-22T18:26:25","modified_gmt":"2021-10-22T12:56:25","slug":"cloud-forensics","status":"publish","type":"post","link":"https:\/\/ismiletechnologies.com\/en_us\/cloud-services\/cloud-forensics\/","title":{"rendered":"Cloud Forensics"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
Overview\u202f\u202f\u00a0<\/span><\/b>\u00a0<\/span><\/h5>

The concept of cloud has truly transformed the technology world and so did the increasing rates of digital and cybercrime. To combat this huge loss, cloud services providers as well as consumers need to establish intelligence that is capable to perform accurate investigations of cloud activities.\u202f Cloud forensics is a sub-domain of digital or computer forensics which deals with investigating and\u00a0analysing\u00a0cloud storage and platforms for artifacts\/potential digital evidence which consists of user activity, photos, videos, files, etc. It is a cross-discipline domain oscillating between Cloud Computing and Digital Forensics. Moreover, Potential Digital Evidence (from now addressed as PDE) is used in the court of law for proving facts regarding any suspect or related entities involved.\u202f\u202f<\/span>\u00a0<\/span><\/p>

\u00a0<\/span><\/p>

Introduction to computer forensics<\/span><\/b>\u00a0<\/span><\/h5>

Computer forensics is a concept which consists of\u00a0analyzing, preserving, and presenting digital data in a way acceptable to the court of law. Considering it just as investigating a crime scene and for any footprints or similar artifacts, we do it for crimes conducted using computers or digital devices. It has a specific procedure.\u202f<\/span>\u00a0<\/span><\/p>

Identification<\/span><\/i>\u00a0<\/span><\/p>

Collection\u202f\u202f\u00a0<\/span><\/i>\u00a0<\/span><\/p>

Preservation\u202f<\/span><\/i>\u00a0<\/span><\/p>

Examination and Analysis\u202f\u00a0<\/span><\/i>\u00a0<\/span><\/p>

Presentation\u202f\u00a0<\/span><\/i>\u00a0<\/span><\/p>

\u00a0<\/span><\/p>

  • Identification<\/span><\/h5><\/li><\/ul>

    Identifying what needs to be\u00a0analyzed\u00a0and what devices should be collected. What will provide potential information is thought in this process. Chain of Custody is very important here. It means documenting who else has handled the data and evidence before handing it over to another person or taking from another person.\u202f\u00a0<\/span><\/p>

    • Collection <\/span><\/h5><\/li><\/ul>

      This phase consists of collecting the evidence which has been identified by the forensics examiners or incident responders. Various forensics tools are used\u00a0to collect digital evidence. For example, FTK Imager tools are used to create a\u00a0bit to bit\u00a0imaging of\u00a0a computer drive or a virtual machine, which then can be used for forensics analysis\u202f\u00a0<\/span><\/p>

      • Preservation<\/span><\/h5><\/li><\/ul>

        This phase\u00a0involves\u00a0preserving the data and evidence from getting tampered. Digital data can be tampered over a network. Faraday bags and\u00a0aluminum\u00a0foil could be used to avoid network connections. The aim is to preserve the originally collected data in the court of law.\u202f\u00a0\u00a0<\/span><\/p>

        • Examination and Analysis<\/span><\/h5><\/li><\/ul>

          Collected data needs to be examined and\u00a0analyzed\u00a0for emails, images, videos, and other similar forensics artifacts. This is the most important phase in the forensics process.\u00a0\u00a0<\/span><\/p>

          • Presentation<\/span><\/h5><\/li><\/ul>

            The presentation consists of reporting whatever findings or artifacts were recovered during the analysis. Reporting aims to make people, especially non-technical audience, understand what the findings are.\u00a0\u00a0<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

            \n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t
            \n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t
            \n\t\t\t\t\t\t\t\t\t
            Cloud\u00a0Forensics\u202f\u00a0<\/span><\/b>\u00a0<\/span><\/h5>

            Cloud platforms are being used at a growing pace for developing and deploying services. There are several benefits associated with cloud platforms such as speed, cost, and performance. There are various types of cloud computing models.\u00a0<\/span>\u00a0<\/span><\/p>

            • SaaS \u2013 Software as a service. Here the cloud provider provides users with the software on the cloud platform. Example \u2013 Google Docs, Office 365, etc.\u202f\u00a0<\/span>\u00a0<\/span><\/li><\/ul>
              • PaaS \u2013 Platform as a service. Here user can deploy the platform using the software functionality. Deployment and testing of the application can be executed efficiently.\u00a0<\/span>\u00a0<\/span><\/li>
              • IaaS \u2013 Infrastructure as a service. Here,\u00a0the whole infrastructure such as Microsoft Azure and AWS is provided to the users. An IT environment can be created here.\u202f\u00a0<\/span>\u00a0<\/span><\/li><\/ul>

                \u00a0<\/span>\u00a0<\/span><\/p>

                Cloud forensics can be divided into three parts.\u202f<\/strong>\u00a0<\/span>\u00a0<\/span><\/p>

                • Technical Process-<\/strong> This phase consists of performing investigation in the cloud using multiple forensics tools, acquiring the images, and performing live forensics.\u202f<\/span>\u00a0<\/span><\/li>
                • Organizational-<\/strong>\u00a0This phase covers\u00a0investigating\u00a0all associated with events,\u00a0stakeholders and entities such as service providers, policies, and SLAs.\u202f<\/span>\u00a0<\/span><\/li>
                • Legal-<\/strong>\u00a0Legal aspects cover all the legislatures associated with acquiring data and conducting forensics, including the geography of the data and entities.\u202f\u00a0<\/span>\u00a0<\/span><\/li><\/ul>

                  \u00a0<\/p>

                  Server-side forensics-\u00a0Investigating servers would lead us to a wealth of potential digital evidence. Information can be found in the following sources: Server, application, database, and authentication logs,\u00a0Access information\u00a0etc.\u00a0<\/span>\u00a0<\/span><\/p>

                  Client-side forensics-\u00a0Most of the attacks or incidents occur on the client-side or at the endpoint. Also, it is relatively easy to get data from the client rather than the server. Sources of potential digital evidence in the client-side\u00a0are:\u00a0Registry files,\u00a0Logs,\u00a0Database files\u00a0etc.\u202fCloud storage platforms such as Dropbox, Google Drive, Microsoft OneDrive, Evernote, etc., have become popular ever since and\u00a0are\u00a0an important aspect of client-side forensics. These platforms consist of valuable information of users. These programs leave important artifacts on the system that are important to forensic investigators. The logs of these platforms can be used to create a for event reconstruction and investigation.\u202f<\/span>\u00a0<\/span><\/p>

                  \u00a0<\/span>\u00a0<\/span><\/p>

                  Challenges in cloud forensics\u202f\u00a0<\/span><\/b>\u00a0<\/span><\/p>

                  Collection of evidence is an issue if the virtual machine which was used by an attacker or which was the target has\u00a0been deleted or reset.\u202f Agreements (SLAs) between the user and cloud service provider or in between cloud service providers have an impact on the forensics standpoint.\u202f\u00a0<\/span>\u00a0<\/span><\/p>

                  Timestamps and Sync dates\u00a0Artifacts \/ PDE in cloud forensics\u202f\u202f<\/strong>\u00a0<\/span>\u00a0<\/span><\/p>

                  • Windows Registry files-\u00a0This is a hot location where investigators can find valuable information regarding the event of security.\u202f \u202f<\/span>\u00a0<\/span><\/li>
                  • Browser Log Files-\u00a0Browser logs consist of cookies, URLs, and cache data, which could be beneficial in an investigation. Logs are stored under the user directory.\u202f\u00a0<\/span>\u00a0<\/span><\/li>
                  • Memory-\u00a0Collecting volatile memory gives a wealth of information to an investigator. Physical memory contains information such as User ID and Passwords.\u202f\u202f\u00a0<\/span>\u00a0<\/span><\/li><\/ul>

                    \u00a0<\/p>

                    In mobile devices<\/span><\/b>\u00a0<\/span><\/p>

                    In IOS operating systems Amazon S3 and Dropbox create an SQLite database file. While Amazon S3 creates a bucket file with the timestamps, Dropbox creates a \u2018Dropbox.sqlite\u2019 file.\u202f<\/span>\u00a0<\/span><\/p>

                    In the Android operating system, a similar system is employed. The downloaded files from the cloud app are stored on the device with details about the login and full path in which the app is installed.\u202f\u00a0<\/span>\u00a0<\/span><\/p>

                    \u00a0<\/span><\/p>

                    Forensics as a Service\u202f\u00a0<\/span><\/b>\u00a0<\/span><\/p>

                    The focus of this service is to provide forensics services over the cloud. As we can see a drastic increase in cloud computing, cloud forensics is gaining momentum too.\u00a0<\/span>\u00a0<\/span><\/p>

                    Virtual Machine Introspection is a method used to monitor run time state of system-level Virtual Machine.\u00a0Terremark\u00a0uses VMI for monitoring, management, and security of its vSphere cloud computing offering.\u202f\u00a0<\/span>\u00a0<\/span><\/p>

                    \u00a0<\/span><\/p>

                    Features of\u00a0FaaS\u202f\u00a0<\/span><\/b>\u00a0<\/span><\/p>

                    • Instance collection \u2013 for aggregating Access Control, and Centralized log monitoring records.\u202f\u00a0<\/span>\u00a0<\/span><\/li>
                    • Verification \u2013 any collected data would be verified based on an accepted standard.\u202f<\/span><\/li><\/ul>

                      \u00a0<\/span>\u00a0<\/span><\/p>

                      CSP Forensics storage\u202f\u00a0<\/span><\/b>\u00a0<\/span><\/p>

                      Security capabilities provided by CSPs\u202fMicrosoft and Google have inbuilt security\u00a0centres\u00a0that have monitoring, logging, and security operations capabilities that are required to handle an incident and contain it.\u202f \u202f\u00a0<\/span>\u00a0<\/span><\/p>

                      iSmile\u00a0Technology Forensics service provides\u00a0automated forensics tool and procedures to execute the task from collection to reporting in digital forensics allows for a fast investigation and insights.\u00a0<\/span>\u00a0<\/span><\/p>

                      Our service\u00a0has the following benefits:\u00a0<\/strong>\u00a0<\/span><\/p>

                      • Cost-effectiveness-\u00a0It works on the flat-rate price model which lets customers know the exact cost of an investigation, allowing for budget management.\u202f<\/span>\u00a0<\/span><\/li><\/ul>
                        • Time for conducting digital forensics investigation-\u00a0Company reputation is a major stake which is affected by an incident, having a plan and\u00a0investigation in hours instead of days would place the organization in a better position.\u202f<\/span>\u00a0<\/span><\/li><\/ul>

                          \u00a0<\/span><\/p>

                          Summary\u202f\u00a0<\/span><\/b>\u00a0<\/span><\/p>

                          Cloud computing is a growing field. Security incidents related to cloud services are growing too. There is a dire need to cloud forensics to investigate the incidents and build methods to prevent it from happening in the future. Forensics as a Service is a newly developed subset under cloud forensics and focuses on providing forensic services over the cloud. It should be considered similar to IaaS, PaaS, and SaaS.\u00a0<\/span>\u00a0<\/span><\/p>

                          \u00a0<\/span><\/p>

                          Ismile\u00a0for Cloud Forensics<\/span><\/b>\u00a0<\/span><\/p>

                          iSmile\u00a0Technologies takes\u00a0care of security on cloud platforms. SIEM, digital forensics, and overall cloud security\u00a0are\u00a0provided.\u00a0<\/span>\u00a0<\/span><\/p>

                          iSmile\u00a0Technologies has extensive experience in setting up from the bottom up, providing consulting services, 24\u00d77 managed services for Cloud Security Monitoring, Cyber Security Incident Response, Pen Testing, Remediation, etc. Feel free to contact us for more details.<\/span>\u00a0<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"

                          Overview\u202f\u202f\u00a0\u00a0 The concept of cloud has truly transformed the technology world and so did the increasing rates of digital and cybercrime. To combat this huge loss, cloud services providers as well as consumers need to establish intelligence that is capable to perform accurate investigations of cloud activities.\u202f Cloud forensics is a sub-domain of digital or […]<\/p>\n","protected":false},"author":3,"featured_media":5821,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[81],"tags":[118],"class_list":["post-2468","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cloud-services","tag-cloud-forensic"],"_links":{"self":[{"href":"https:\/\/ismiletechnologies.com\/en_us\/wp-json\/wp\/v2\/posts\/2468","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ismiletechnologies.com\/en_us\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ismiletechnologies.com\/en_us\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ismiletechnologies.com\/en_us\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/ismiletechnologies.com\/en_us\/wp-json\/wp\/v2\/comments?post=2468"}],"version-history":[{"count":6,"href":"https:\/\/ismiletechnologies.com\/en_us\/wp-json\/wp\/v2\/posts\/2468\/revisions"}],"predecessor-version":[{"id":19621,"href":"https:\/\/ismiletechnologies.com\/en_us\/wp-json\/wp\/v2\/posts\/2468\/revisions\/19621"}],"wp:attachment":[{"href":"https:\/\/ismiletechnologies.com\/en_us\/wp-json\/wp\/v2\/media?parent=2468"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ismiletechnologies.com\/en_us\/wp-json\/wp\/v2\/categories?post=2468"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ismiletechnologies.com\/en_us\/wp-json\/wp\/v2\/tags?post=2468"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}