Following the breadcrumbs: Timestamp pattern identification for cloud forensics

被引：11
|
作者：
Ho, Shuyuan Mary [1 ]
Kao, Dayu [2 ]
Wu, Wen-Ying [2 ]
机构：
[1] Florida State Univ, Sch Informat, Tallahassee, FL 32306 USA
[2] Cent Police Univ, Dept Informat Management, Taoyuan, Taiwan
来源：
DIGITAL INVESTIGATION | 2018年 / 24卷
关键词：
Timestamp; Cloud forensics; Behavioral analysis; Pattern identification; File metadata;
D O I：
10.1016/j.diin.2017.12.001
中图分类号：
TP [自动化技术、计算机技术];
学科分类号：
0812 ;
摘要：
This study explores the challenges of digital forensics investigation in file access, transfer and operations, and identifies file operational and behavioral patterns based on timestamps-in both the standalone as well as interactions between Windows NTFS and Ubuntu Ext4 filesystems. File-based metadata is observed, and timestamps across different cloud access behavioral patterns are compared and validated. As critical metadata information cannot be easily observed, a rigorous iterative approach was implemented to extract hidden, critical file attributes and timestamps. Direct observation and cross-sectional analysis were adopted to analyze timestamps, and to differentiate between patterns based on different types of cloud access operations. Fundamental observation rules and characteristics of file interaction in the cloud environment are derived as behavioral patterns for cloud operations. This study contributes to cloud forensics investigation of data breach incidents where the crime clues, characteristics and evidence of the incidents are collected, identified and analyzed. The results demonstrate the effectiveness of pattern identification for digital forensics across various types of cloud access operations. (c) 2018 Elsevier Ltd. All rights reserved.
引用
收藏
页码：79 / 94
页数：16
相关论文
共 50 条
  • [1] Timestamp Patterns in Windows Forensics
    Luh, Robert
    Galhuber, Michael
    [J]. ERCIM NEWS, 2022, (129): : 27 - 28
  • [2] SIDNFF: Source Identification Network Forensics Framework for Cloud Computing
    khan, Suleman
    Gani, Abdullah
    Wahab, Ainuddin Wahid Abdul
    Bagiwa, Mustapha Aminu
    [J]. 2015 IEEE INTERNATIONAL CONFERENCE ON CONSUMER ELECTRONICS - TAIWAN (ICCE-TW), 2015, : 418 - 419
  • [3] Irinotecan therapy—following a trail of breadcrumbs?
    Richard M. Goldberg
    Bert H. O'Neil
    [J]. Nature Reviews Gastroenterology & Hepatology, 2009, 6 : 507 - 509
  • [4] A Cloud Forensics Method Based on SDS and Cloud Forensics Trend Analysis
    Liu X.
    Ding L.
    Liu W.
    Zheng T.
    Li Y.
    Wu J.
    [J]. Jisuanji Yanjiu yu Fazhan/Computer Research and Development, 2019, 56 (10): : 2262 - 2276
  • [5] Digital Forensics Research on Cloud Computing: An investigation of Cloud Forensics Solutions
    Morioka, Erni
    Sharbaf, Mehrdad S.
    [J]. 2016 IEEE SYMPOSIUM ON TECHNOLOGIES FOR HOMELAND SECURITY (HST), 2016,
  • [6] Towards interactive event log forensics: Detecting and quantifying timestamp imperfections
    Fischer, D. A.
    Goel, K.
    Andrews, R.
    van Dun, C. G. J.
    Wynn, M. T.
    Roeglinger, M.
    [J]. INFORMATION SYSTEMS, 2022, 109
  • [7] Role of Cloud Forensics in Cloud Computing
    Mohiddin, Shaik Khaja
    Babu, Yalavarthi Suresh
    [J]. SOFT COMPUTING FOR PROBLEM SOLVING, SOCPROS 2018, VOL 2, 2020, 1057 : 91 - 107
  • [8] Towards interactive event log forensics: Detecting and quantifying timestamp imperfections
    Fischer, D.A.
    Goel, K.
    Andrews, R.
    van Dun, C.G.J.
    Wynn, M.T.
    Röglinger, M.
    [J]. Information Systems, 2022, 109
  • [9] Dead timestamp identification in Stampede
    Harel, N
    Mandviwala, HA
    Knobe, K
    Ramachandran, U
    [J]. 2002 INTERNATIONAL CONFERENCE ON PARALLEL PROCESSING, PROCEEDING, 2002, : 101 - 108
  • [10] Implementation of a Cloud Computing Framework for Cloud Forensics
    Patrascu, Alecsandru
    Patriciu, Victor Valeriu
    [J]. 2014 18TH INTERNATIONAL CONFERENCE SYSTEM THEORY, CONTROL AND COMPUTING (ICSTCC), 2014, : 440 - 445
12345