Staas Clouds Using the Open Cloud Forensics Model

The rapid adoption of cloud computing to meet storage and computation needs has changed the way computing services and resources are used. However, because of the black-box nature and multi-tenant usage models of clouds, existing digital forensics science cannot cope with current state-of-the-art cloud architectures. Because of the fundamental characteristics of such clouds, many assumptions of digital forensics are invalidated. In the digital forensics process involving clouds, the role of cloud service providers (CSPs) is extremely important; a role which needs to be considered in the science of cloud forensics. In this paper, we define cloud forensics while considering the role of the CSP and propose the Open Cloud Forensics (OCF) model. The OCF model focuses on preserving sufficient electronically stored information (ESI) required to investigate cases involving clouds and ensuring the trustworthiness of such ESI. Based on this we propose two cloud architectures: the OCF-supported Infrastructure-asa-Service (IaaS) cloud and the OCF-supported Storage-as-a-Service (StaaS) cloud. We validate our proposed models using a case study, which is inspired from an actual civil lawsuit.