Cloud computing expands the scale of digital forensic activities. It also creates new cybercrime investigations with new challenges.

Cloud computing is a service you cannot ignore. Gartner predicts that cloud service revenue will be about $150 billion in 2013. With all of this comes the growing amount of data that will be accumulated, and the implications of the use of the cloud for situations that require forensic analysis. The amount of data that needs to be analyzed can be tens to hundreds of gigabytes in a single investigation.

The forensic professional's goal is to obtain information that can be used in court, and cloud computing expands the scale of digital forensic activities. It also creates new cybercrime investigations with new challenges.

Cloud forensics means new experts with new tools. Cloud forensics is a combination of digital forensics and cloud computing. Cloud computing, by definition, means sharing resources such as networks, storage, servers, applications, and other services. The sharing is performed by the cloud service and it involves multiple enterprises using common solutions.

A major value of cloud computing is its ability to reconfigure resources quickly. This means that resources can change almost instantly, which in turn means that virtualization compounds the forensic data location problem.

XaaS Models and Forensics
The Infrastructure as a Service (IaaS) model produces the fewest obstacles for the forensic expert. It is basically providing a physical data center outside the enterprise, but with all of the enterprise's work performed by enterprise staff. The management of the operating system may be shared.

Platform as a Service (PaaS) adds the management of the runtime and middleware by the service provider. This adds to the complexity faced by the forensic professional.

Software as a Service (SaaS) effectively outsources the entire IT operation. The enterprise becomes a subscriber to the service. SaaS is the most difficult environment for the forensic professional to operate within because most of the control of the applications and data is with the SaaS service provider.

The structure of your cloud provider's business will depend on the business model they are working under. A SaaS provider can easily be running its service on an IaaS or PaaS cloud, therefore you will be really working with two providers, not one for forensic purposes. A third-party reseller may be the face of the cloud service, adding another layer to the arrangement.

Next page: Elements of cloud forensics