Investigation Procedure for cloud storage forensic: Law Enforcement Perspective

Abstract

Cloud storage forensics is a part of digital forensics. It’s a hybrid approach of digital and network forensics. At present time, the usage of cloud storage for store data is increasing day by day because user can access the data from any place and it’s very secure. So the crime is also increasing in cloud storage day by day. Peoples keep the unethical file like child pornography, antigovernment activity etc. But it is quite difficult for forensic analyzer to find out evidence from cloud storage than device’s storage. Because in cloud storage the location of storage is not fixed and pick up any individual user’s data is quite impossible if he/she doesn’t cooperate. And if the file is deleted from cloud storage then it will be more difficult to get. So, suspect of digital crime is out of guilty from court of law for without proper evidences. There is no proper procedure for cloud storage forensic. Every law enforcement agency is doing investigation with their own procedure but sometimes it may not work and suspects are free from court. So criminal get inspiration for using cloud storage for criminal activities. There have been developed some procedure for cloud storage investigation like legal approach and technical approach. In legal approach law-enforcement agencies contact with Cloud Service Provider for evidence if they give then analyze. If they unable to collect user’s data from law-enforcement agencies, then they may try some technical approach. In technical approach law-enforcement agencies use some tools like Encase, Oxygen Forensics, FTK Imager etc. for collecting the evidence. Using this approaches forensic analyzer can find the evidences from cloud storage.