API-Based Forensic Acquisition of Cloud Drives - Inria - Institut national de recherche en sciences et technologies du numérique Accéder directement au contenu
Communication Dans Un Congrès Année : 2016

API-Based Forensic Acquisition of Cloud Drives

Vassil Roussev
  • Fonction : Auteur
  • PersonId : 1030297

Résumé

Cloud computing and cloud storage services, in particular, pose new challenges to digital forensic investigations. Currently, evidence acquisition for these services follows the traditional method of collecting artifacts residing on client devices. This approach requires labor-intensive reverse engineering effort and ultimately results in an acquisition that is inherently incomplete. Specifically, it makes the incorrect assumption that all the storage content associated with an account is fully replicated on the client. Additionally, there is no current method for acquiring historical data in the form of document revisions, nor is there a way to acquire cloud-native artifacts from targets such as Google Docs.This chapter introduces the concept of API-based evidence acquisition for cloud services, which addresses the limitations of traditional acquisition techniques by utilizing the officially-supported APIs of the services. To demonstrate the utility of this approach, a proof-of-concept acquisition tool, kumodd, is presented. The kumodd tool can acquire evidence from four major cloud drive providers: Google Drive, Microsoft OneDrive, Dropbox and Box. The implementation provides command-line and web user interfaces, and can be readily incorporated in established forensic processes.
Fichier principal
Vignette du fichier
431606_1_En_11_Chapter.pdf (807.73 Ko) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)
Loading...

Dates et versions

hal-01758692 , version 1 (04-04-2018)

Licence

Paternité

Identifiants

Citer

Vassil Roussev, Andres Barreto, Irfan Ahmed. API-Based Forensic Acquisition of Cloud Drives. 12th IFIP International Conference on Digital Forensics (DF), Jan 2016, New Delhi, India. pp.213-235, ⟨10.1007/978-3-319-46279-0_11⟩. ⟨hal-01758692⟩
162 Consultations
743 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More