Analyzing Data Remnant Remains on User Devices to Determine Probative Artifacts in Cloud Environment

Ahmed, Abdulghani Ali and Chua, Xue Li (2018) Analyzing Data Remnant Remains on User Devices to Determine Probative Artifacts in Cloud Environment. Journal of Forensic Sciences, 63 (1). pp. 112-121. ISSN 0022-1198. (Published)

[img]
Preview
PDF
Final Draft.pdf

Download (435kB) | Preview

Abstract

Cloud storage service allows users to store their data online, so that they can remotely access, maintain, manage, and back up data from anywhere via the Internet. Although helpful, this storage creates a challenge to digital forensic investigators and practitioners in collecting, identifying, acquiring, and preserving evidential data. This study proposes an investigation scheme for analyzing data remnants and determining probative artifacts in a cloud environment. Using pCloud as a case study, this research collected the data remnants available on end-user device storage following the storing, uploading, and accessing of data in the cloud storage. Data remnants are collected from several sources, including client software files, directory listing, prefetch, registry, network PCAP, browser, and memory and link files. Results demonstrate that the collected remnants data is beneficial in determining a sufficient number of artifacts about the investigated cyber crime.

Item Type: Article
Additional Information: Indexed by Scopus
Uncontrolled Keywords: Forensic science; Digital forensic; Cloud storage; Cybercrime investigation; PCloud; Evidence collection; Data remnants; Artifacts
Subjects: Q Science > QA Mathematics > QA76 Computer software
Faculty/Division: Faculty of Computer System And Software Engineering
Depositing User: Dr. Abdulghani Ali Ahmed
Date Deposited: 07 Jun 2018 01:42
Last Modified: 07 Jun 2018 01:42
URI: http://umpir.ump.edu.my/id/eprint/20097
Download Statistic: View Download Statistics

Actions (login required)

View Item View Item