1 DIGITAL FORENSIC INVESTIGATION OF CLOUD STORAGE SERVICES Hyunji Chung, Jungheum Park, Sangjin Lee, Cheulhoon Kang Presented by: Abdiwahid Abubakar Ahmed, ID #
2 2 OUTLINE 1. Introduction 2. Cloud storage services and digital forensics 3. Artifacts of cloud storage services (Windows and Mac) 4. Artifacts of cloud storage services (smartphones) 5. Case study of a cloud storage service 6. Discussion and conclusions
4 4 CLOUD COMPUTING: Computing resources delivered as a service over a network The name comes from the cloud-shaped source:
5 5 1. INTRODUCTION Cloud computing was expanded: Development of an information technology infrastructure Availability of free software and advanced virtualization technology CC services divisions (in terms of resources provided): SaaS (software as a service) PaaS (platform as a service) IaaS (infrastructure as a service).
6 6 SaaS (SOFTWARE as a SERVICE) software delivery model in which software and associated data are centrally hosted on the cloud typically accessed via a web browser.
7 7 PaaS (PLATFORM as a SERVICE) The provider provides the networks, servers, storage and as a service. The consumer creates the software, deployment and make configuration.
8 8 IaaS (INFRASTRUCTURE as a SERVICE) Providers offer computers and other resources on-demand. Users install operating-system images and their applications infrastructure, patch and maintain the OS and the softwares.
9 9 CLOUD STORAGE A type of IaaS, provide users with virtual space which allows users to store data such as documents, images, and music files. It also offers additional services such as editing, player, and -sending capacity. Accessible from PC or a smartphone and this helped the expansion of cloud storage.
10 10 WHERE WE CAN FIND DF INFORMATION hosting companies keep confidentiality. We can analyze traces stored in user s device. conventional digital forensic methods are insufficient. We combine conventional computer forensics with mobile forensics to get useful information.
11 11 McClain, 2011 Dropbox traces Windows installation directory registry changes on installation network activity database files log files, and uninstallation data what kind of data exists how they can be utilized to investigate did not explain specifically Dropbox traces in smartphones Dropbox can be accessed via a smartphone
12 12 HOW IS THIS PAPER ORGANIZED It looks traces left in local devices (PC and smartphones). All devices for a single user s cloud storage must be examined when conducting digital forensics It presents methods for collecting and analyzing evidence about a variety of the cloud storage services currently available.
13 13 HOW IS THIS PAPER ORGANIZED Section 2 discusses methods for forensic investigation of cloud storage services, and important factors that should be considered in a forensic investigation. Section 3 deals with the traces that are created with a Windows and Mac system. Section 4 deals with the traces that are left when ios and Android OS for smartphone are used
14 14 HOW IS THIS PAPER ORGANIZED Section 5 presents a crime scenario involving a cloudstorage service and describes an investigation method. Section 6 presents the conclusions
15 15 2. CLOUD STORAGE SERVICES AND DIGITAL FORENSICS Cloud storage services A type of IaaS Their use is increasing can be accessed through a Web browser Available in different platforms The artifacts in PCs and smartphones differ due to different services
16 16 Services demonstrated in this paper: Amazon S3, Google Docs,Dropbox, and Evernote. COMMON WAY TO USE Type of service Public services PC (Windows, Mac) Web browser or Client program Smartphone (ios, android) Application Data storage Office suite + data storage Note storage + data storage Amazon S3, Dropbox, Sugarsync, and so on Google Docs, SkyDrive Evernote, Awesome Note
17 2.1. PROCEDURE FOR DIGITAL INVESTIGATION OF CLOUD STORAGE SERVICES The investigator collects and analyzes data from all devices that a user has used to access a cloud storage service. Such devices include PCs, smartphones, tablet PCs, and PDAs, but this paper covers only PCs and smartphones, which are the mostly widely used devices. 17
18 PROCEDURE FOR INVESTIGATION OF A CLOUD STORAGE SERVICE 18 Figure 1, page 3
19 IMPORTANT FACTORS IN AN INVESTIGATION Log files of web browsers Internet Explorer and Firefox log files in profile directory. Cache - images, icons, text, HTML, XML files, download URLs, download times, and data sizes History - visited URLs, titles of Web pages, the times of visits, and the number of visits Cookie - hosts, paths, cookie modification & expiration times, names, and values and download - local paths of downloaded files, download URLs, file sizes, download times, and status This paper focuses on log files of Internet Explorer and Firefox
20 ARTIFACTS OF CLIENT APPLICATIONS IN PC Left traces in the registry, and log files and database files. Logins status Used or denied services & synchronization
21 ARTIFACTS IN SMARTPHONES Database files, XML files, and plist files Physical memory Information about users (IDs and passwords ) Collecting physical memory is possible when doing live forensics. This is beyond the focus of this paper
23 3. ARTIFACTS OF CLOUD STORAGE SERVICES (WINDOWS AND MAC) 3.1. AMAZON S3 Amazon S3 is a Web-based cloud storage service and provides various APIs. Many cloud storage services are built using APIs. 23
24 WINDOWS [IE 8.0] 24
25 WINDOWS [IE 8.0] The first and second fields in this file are the user s canonical ID and bucket name The third field is the time at which the user performed the action. The seventh field describes the user s action. The eighth field is the name of the file on which the user acted. The last field is the HTTP user-agent value
26 MAC [Firefox 9.0.1] Possibility of uploading, downloading files & logging General forensic tools are needed for investigation The artifacts of Amazon S3 are deleted when browser is closed. EnCase can be used to restore.
27 DROPBOX A frequently used cloud storage service. Allows sync and the user can access their storage using Windows, Mac, iphones, and Android
28 WINDOWS 28
29 29 The investigator can find the suspect s dropbox_path by copying config.db to that PC, and then places config.db in the same path as the suspect s dropbox_path.
30 EVERNOTE Evernote allows a user to store an idea anywhere and anytime. Evernote synchronizes notes every time they are saved. Accessible through Windows, Mac, iphones, and Android smartphones.
31 WINDOWS Title Date_cre ated Date_upd ated is_delete d Source Latitude Longitud e Evernote test Mobile.a ndroid Table 8 [userid].exb.
32 WINDOWS 32
33 33 The file [userid].exb.thumbnails is a combination of PNG files that take a snapshot of the note at every synchronization.
34 34 AppLog_[Date].txt is created once a day when Evernote starts. Inside it is the authentication information, the account ID, and start and end time. enclipper_[date].txt is created once a day, like AppLog_[Date].txt. It includes application start time.
35 MAC Important four files in Appendix B are Evernote.sql, fullscreenthumbnail.png, thumbnail.png, and Evernote.log.
37 3.4. GOOGLE DOCS Web-based service that offers flexibility to be productive from one s desk, on the road, at home and on a mobile phone. Originaly classified as a SaaS 37 Recently begun to support mobile access by iphone and Android.
41 41 5. CASE STUDY OF A CLOUD STORAGE SERVICE 5.1. Case overview In 2011, documents containing designs for a new product had been leaked to a competitor. The file name is A_design.pdf. prime suspect was a Mr. K, credential files manager. After checking data logs there were no trace remained Mr. K PC and Android became target devices. The PC and smartphone were seized for forensic examination. PC was Windows 7 and the mobile was Android.
42 Objective judge whether or not Mr. K had leaked a secret file by investigating his PC and smartphone Method The investigation started with Mr. K s PC. The leaked file was not detected. issued a search and seizure warrant. The investigator realized that the suspect used Dropbox The suspect found
43 RESULTS Confidential file using Dropbox. Further examining the prime suspect s PC and smartphone together, more precise investigation was possible.
44 44 6. DISCUSSION AND CONCLUSIONS The availability of cloud storage has spread of cloud storage services. possible for malicious users to abuse cloud storage services Until now, artifact examination can be done only in PCs. This method fails to provide information not available in the PC. This paper has proposed a process model
45 45 6. DISCUSSION AND CONCLUSIONS For forensic investigation of cloud storage services It described some important elements of an investigation. It also described a previously unknown method for forensic analysis of cloud storage services. This methodology is helpful in the investigation of cloud storage services.
Int'l Conf. Security and Management SAM'15 3 Analysis of Evidence in Cloud Storage Client Applications on the Windows Platform R. Malik 1, N. Shashidhar 1, and L. Chen 2 1 Department of Computer Science,
Cloud Storage Client Application Analysis Rakesh Malik Department of Computer Science Sam Houston State University Huntsville, TX 77341, USA Narasimha Shashidhar Department of Computer Science Sam Houston
Manual for Android 1.5 1 Table of Content 1. Scope of Service... 3 1.1 About Boxcryptor Classic... 3 1.2 About this manual... 3 2. Installation... 4 3. Basic functionality... 5 3.1. Setting up Boxcryptor
Introduction to Cloud Services (brought to you by www.rmroberts.com) Cloud computing concept is not as new as you might think, and it has actually been around for many years, even before the term cloud
DEPARTMENT OF EDUCATION Office 365 Cheat Sheet OneDrive for Business Introduction to OneDrive for Business OneDrive for Business is a new offering within Office 365 that has been enabled for all NTSchools
A Gladinet White Paper http://www.gladinet.com Gladinet Cloud Access Solution Simple, Secure Access to Online Storage October 12 Contents Introduction 2 Problem Statement 2 Previous Options Error! Bookmark
Personal Cloud Support Guide for Mac Computers Storing and sharing your content 2 Getting started 2 How to use the application 2 Managing your content 2 Adding content manually 3 Renaming files 3 Moving
CLOUD STORAGE FORENSICS MATTIA EPIFANI SANS EUROPEAN DIGITAL FORENSICS SUMMIT PRAGUE, 7 OCTOBER 2013 SUMMARY Cloud Storage services Testing environment and methodology Forensics artifacts left by Cloud
Store & Share Quick Start What is Store & Share? Store & Share is a service that allows you to upload all of your content (documents, music, video, executable files) into a centralized cloud storage. You
Demo Access AUTHOR: System4u BlackBerry Universal Device Service Revisions Date Version Description Author June 26 th 2012 1.0 Roman Přikryl September 25 th 2012 1.5 Revision Roman Přikryl October 5 th
NEC CLOUD STORAGE Demo Guide 2014 1 INTRODUCTION... 4 1.1 GOALS OF THIS DOCUMENT... 4 1.2 TERMS, ACRONYMS AND ABBREVIATIONS... 4 2 INTRODUCTION TO NEC CLOUD STORAGE... 5 2.1 WHAT IS NEEDED TO USE CLOUD
Table of Contents How to Access Your Account How to Upload Files How to Download the Desktop Sync Folder Sync Folder How to Share a File 3 rd Party Share from Web UI 3 rd Party Share from Sync Folder Team-Share
Installation and Setup of Google Drive for Students on Mac OS X Purpose: This guide will lead you through the Google Drive Installation and Configuration. Pre-requisites: 1) ODU Student Gmail account 2)
Please read this entire document it contains important instructions that will help you with the setup and maintenance of your DUO account. PLEASE NOTE: Use of a smartphone is the fastest and simplest way
GO!Enterprise MDM Device Application User Guide Installation and Configuration for ios Devices GO!Enterprise MDM for ios Devices, Version 3.x GO!Enterprise MDM for ios Devices 1 Table of Contents GO!Enterprise
activecho Frequently Asked Questions What are the benefits of activecho? activecho allows your organization to provide an on-premise, managed and secure alternative to Dropbox and other file synching and
Quick View ü You MUST be logged in to access any information inside the IONU system. If you aren t logged in, you will not see the folders and the data and files cannot be accessed and decrypted. ü All
The Genealogy Cloud: Which Online Storage Program is Right For You Thomas MacEntee, of High-Definition Genealogy http://hidefgen.com firstname.lastname@example.org Clouds in Genealogy? What is the Genealogy Cloud?
Personal Cloud Support Guide for Mobile Apple Devices Storing and sharing your content 2 Getting started 2 How to use the application 2 Managing your content 2 Adding content manually 2 Downloading files
OneDrive for Business User Guide IRM Department Table of Contents Section A Exploring OneDrive for Business... 3 Features... 3 Accessing OneDrive for Business... 3 Section B Installing OneDrive for Business
Organizing Electronic Documents and Records in Systems (5-4) K.J. McCorry Organizing Electronic Documents and Records in Systems Presented by: K.J. McCorry Officiency, Inc. www.officiency.com 1 Your Content
Cloud Hosted Data in Digital Forensics Session overview What is cloud storage? Do we need to worry about it? Collection considerations Forensic artefacts from: Google Drive Office 365/OneDrive Forensic
CNJG Annual Meeting Pre-Meeting Workshop Presentors: David Binder, Dir., IT Don Debias, Help Desk Mgr. John Bednar, Sr. Help Desk Specialist Agenda Overview of current state of technology Hardware Software
Document OwnCloud Collaboration Server (DOCS) User Manual How to Access Document Storage You can connect to your Document OwnCloud Collaboration Server (DOCS) using any web browser. Server can be accessed
BlackBerry Enterprise Service 10 Secure Work Space for ios and Android Version: 10.1.1 Security Note Published: 2013-06-21 SWD-20130621110651069 Contents 1 About this guide...4 2 What is BlackBerry Enterprise
Using the owncloud Android App Accessing your files on your owncloud server via the Web interface is easy and convenient, as you can use any Web browser on any operating system without installing special
Recovering Residual Forensic Data from Smartphone Interactions with Cloud Storage Providers George Grispos University of Glasgow email@example.com Abstract 1 Tim Storer University of Glasgow
Quick View You MUST be logged in to access any information inside the IONU system. If you aren t logged in, you will not see the folders and the data and files cannot be accessed and decrypted. All files,
Table of Contents Description of the BlackVue App 3 Features 3 Supported Devices 4 Screen Description 5 Home Screen 5 Video List Screen 6 Connection of BlackVue to a Wi-Fi connection 7 Menu Description
PaperStream Connect Setup Guide Version 188.8.131.52 Copyright Fujitsu 2014 Contents Introduction to PaperStream Connect... 2 Setting up PaperStream Capture to Release to Cloud Services... 3 Selecting a Cloud
Technical Support Set-up Procedure How to Setup the Amazon S3 Application on the DSN-320 Amazon S3 (Simple Storage Service) is an online storage web service offered by AWS (Amazon Web Services), and it
White Paper Enterprise File Serving 2.0 Anywhere, Any Device File Access with IT in Control Like it or not, cloud- based file sharing services have opened up a new world of mobile file access and collaborative
Personal Cloud Support Guide for Windows Mobile Devices Storing and sharing your content 2 Getting started 2 How to use the application 2 Managing your content 2 Adding content manually 2 Viewing statistics
APPENDIX B1 - FUNCTIONALITY AND INTEGRATION REQUIREMENTS RESPONSE FORM FOR A COUNTY HOSTED SOLUTION Response Code: Offeror should place the appropriate letter designation in the Availability column according
Cloud Web-Based Operating System (Cloud Web Os) Hesham Abusaimeh Department of Computer Science, Faculty of Information Technology, Applied Science University, Amman, 11931 Jordan. ABSTRACT The cloud computing
Sophos Mobile Control Installation guide Product version: 3 Document date: January 2013 Contents 1 Introduction...3 2 The Sophos Mobile Control server...4 3 Set up Sophos Mobile Control...16 4 External
ShareSync Get Started Guide WHAT IS SHARESYNC? ShareSync is a cloud file sync and share service. ShareSync allows you to easily sync files between multiple computers, the ShareSync web portal and mobile
Frequently Asked Questions Share Drive Frequently Asked Questions Table of Contents How do I change my password?... How do I reset my password if I forgot it?... How do I share files/folders with Groups
This document includes: Welcome to Office 365! What is Office 365? How do I access Office 365? Create and Access Your Documents from Anywhere with SkyDrive Pro Connect and Collaborate through Office 365
Cloud Computing for Education Workshop 2012 Copyright REZA CURTMOLA, NJIT Why Should You Learn This? Learn some useful software and services Backup and sync your materials for teaching Data reliability
Sophos Mobile Control Startup guide Product version: 3.5 Document date: July 2013 Contents 1 About this guide...3 2 What are the key steps?...5 3 Log in as a super administrator...6 4 Activate Sophos Mobile
2015 Mobile Iron User Guide Information technology Sparrow Health System 9/1/2015 Contents...0 Introduction...2 Changes to your Mobile Device...2 Self Service Portal...3 Registering your new device...4
GO!Enterprise MDM Device Application User Guide Installation and Configuration for Android with TouchDown GO!Enterprise MDM for Android, Version 3.x GO!Enterprise MDM for Android with TouchDown 1 Table
Advanced Configuration Steps After you have downloaded a trial, you can perform the following from the Setup menu in the MaaS360 portal: Configure additional services Configure device enrollment settings
This document is an overview of the features that are included in the Soonr Workplace Enterprise Plan. The Enterprise Plan is designed for the specific needs of IT departments in larger companies where
Novell Filr 1.0.x Mobile App Quick Start February 2014 Novell Quick Start Novell Filr allows you to easily access all your files and folders from your desktop, browser, or a mobile device. In addition,
Flexible Identity Federation User guide version 1.0.1 Publication History Date Description Revision 2015.09.25 initial release 1.0.0 2015.12.10 minor corrections 1.0.1 Copyright Orange Business Services
MobileLink User Guide April 2013 Table of Contents Section MobileLink Overview Section 1 MobileLink Features Section 2 Enterprise Search Directory Section 2.1 Call History Section 2.2 Service Management
Sophos Mobile Control SaaS startup guide Product version: 6 Document date: January 2016 Contents 1 About this guide...4 2 About Sophos Mobile Control...5 3 What are the key steps?...7 4 Change your password...8
How to use Dropbox Please read the University of Melbourne Guidelines on Dropbox and University Information prior to use. What is Dropbox Dropbox lets you easily share and collaborate on documents with
The Current and Future State of IT When, Where, and How To Leverage the The and the Players Software as a Service Citrix VMWare Google SalesForce.com Created and Presented by: Rand Morimoto, Ph.D., MCITP,
Introduction to Cloud Storage What is Cloud Storage? Cloud computing is one method to store and access data over the internet instead of using a physical hard drive (e.g. computer s hard drive, flash drive,
AUT OneDrive for Business Instructions for Using OneDrive on Windows Platform Contents 1 What s OneDrive for Business?... 3 2 Storing Files... 5 1.1 Saving and Opening files from your Office applications...
SOOKASA WHITEPAPER SECURITY SOOKASA.COM Sookasa Overview Sookasa was founded in 2012 by a team of leading security experts. The company s patented file-level encryption enables enterprises to protect data
Introduction to Engineering Using Robotics Experiments Lecture 18 Cloud Computing Yinong Chen 2 Big Data Big Data Technologies Cloud Computing Service and Web-Based Computing Applications Industry Control
BCA LG 10+11 Using (Free) Web- Based Applications: File Storage, Sharing and Presentation Alicia Neptune TA 24 Overview: Dropbox is a cloud storage provider. Its main purpose is to store files. It is a
Getting Started with VMware Horizon View (Remote Desktop Access) Use The Links Below To Navigate This Document Using VMware Horizon View with Tablet and Smartphone APP or Mobile Web Browser Walk Through
Performance Analysis of Client Side Encryption Tools Subrata Kumar Das 1, Md. Alam Hossain 2, Md. Arifuzzaman Sardar 3, Ramen Kumar Biswas 4, Prolath Dev Nath 5 Abstract Client side encryption tools are
ShareSync Get Started Guide WHAT IS SHARESYNC? ShareSync is a cloud backup and file sync and share service. ShareSync allows you to easily sync files between multiple computers, the ShareSync web App and
Cloud Computing Chapter 1 Introducing Cloud Computing Learning Objectives Understand the abstract nature of cloud computing. Describe evolutionary factors of computing that led to the cloud. Describe virtualization
Commack UFSD Remote Access for Microsoft Windows Vista, 7 and 8 Apple Macs, ipads, iphones And Android devices This allows district staff and students to access the Commack UFSD network from home or anywhere
GO!Enterprise MDM Device Application User Guide Installation and Configuration for Android GO!Enterprise MDM for Android, Version 3.x GO!Enterprise MDM for Android 1 Table of Contents GO!Enterprise MDM
HiDrive Intelligent online storage for private and business users. Learn about our many product features! Contents 4 Everything, always and everywhere My file is your file Easy backup 5 Public folder Share
Mohawk College VPN User Guide Introduction Connecting to the VPN Supported operating systems and browsers Mapping network drives Introduction Mohawk College VPN (Virtual Private Network) service provides
Egnyte for Power and Standard Users User Guide Egnyte Inc. 1350 West Middlefield Road. Mountain View, CA 94043, USA Phone: 877-7EGNYTE (877-734-6983) Revised June 2015 Table of Contents Chapter 1: Getting
E-Guide SIX ENTERPRISE CLOUD STORAGE AND FILE-SHARING SERVICES TO CONSIDER E ach enterprise cloud service has different capabilities. This expert E-Guide deep dives into how to know what you re getting
Cloud Computing Adam Barker 1 Overview Introduction to Cloud computing Enabling technologies Different types of cloud: IaaS, PaaS and SaaS Cloud terminology Interacting with a cloud: management consoles
PolyU Connect OneDrive for Business User Guide Version 2.4 Last Update: 7 October 2014 PolyU Connect: www.polyu.edu.hk/connect ITS HelpCentre Support: www.polyu.edu.hk/hots ITS HelpCentre Support Hotline:
Shafiq Khan An Introduction to Cloud Computing 13/12/2012 Who we are. > Part of East Lancashire Chamber of Commerce > Web design agency established in 1998 > Customer focused with web solutions for every
Digital Forensics Lab 10: Cloud Computing & the Future of Digital Forensics Today's Topics Cloud Computing Overview Applications of Cloud Computing Impact of CC to Digital Forensics Future of Digital Forensics
Sophos Mobile Control Installation guide Product version: 3.6 Document date: November 2013 Contents 1 Introduction...3 2 The Sophos Mobile Control server...5 3 Set up Sophos Mobile Control...11 4 External
Expert Reference Series of White Papers Windows 8.1 Client to Microsoft s Cloud Services 1-800-COURSES www.globalknowledge.com Windows 8.1 Client to Microsoft s Cloud Services Michael Porter, MCSE, MCT,
Cloud Computing TODAY S TOPICS What Cloud Computing is and How it Works Security & Privacy Issues Investigative Challenges WHAT IS CLOUD COMPUTING? Cloud computing refers to software or processes offered
Qsync Qsync is a cloud based file synchronization service empowered by QNAP Turbo NAS. Simply add files to your local Qsync folder, and they will be available on your Turbo NAS and all its connected devices.
ACCESSING MICROSOFT OFFICE 365 FREE STUDENT RESOURCES Download and Installation instructions 1. Go here and sign into Office 365 with your username and password. Username: Unitecusername@myunitec.ac.nz
IHS owncloud: IHS Sync Storage The secure and convenient alternative to Dropbox et al. Why IHS owncloud? Large storage space for increased productivity: IHS users have access to 15 GB of IHS owncloud file
Dropbox (Free)- Dropbox is a great file storage application that saves your documents using the cloud, and makes them available anywhere you are connected to the Internet. The Dropbox App, available in