PaperlayerView exact revision on arXiv

Source-linked AI summary

Digital Forensic Investigation of Cloud Storage Services

Hyunji Chung, Jungheum Park, Sangjin Lee, Chulhoon Kang

arXiv:1709.10395v1cs.CR

TL;DR

Cloud-storage forensics is constrained by unavailable server logs and incomplete evidence on individual devices. This paper proposes examining artifacts across accessible computers and smartphones, and shows through a Dropbox case that analyzing a PC and Android smartphone together enabled a more precise investigation of a confidential-file leak.

  • Problem

    Investigators cannot fully reconstruct cloud-storage use from server logs and must locate complementary traces across users’ accessible devices.

  • Method

    The paper proposes a forensic process for collecting and analyzing cloud-storage artifacts across Windows, Mac, iOS, and Android devices, with lawful cloud access where possible.

  • Results

    Analyzing a suspect’s PC and Android smartphone together identified a confidential-file leak through Dropbox and enabled a more precise investigation.

  • Takeaways & Limitations

    Cloud-storage investigations should examine all accessible devices because their artifacts can provide complementary evidence beyond a PC alone.

  • Takeaways & Limitations

    The paper does not focus on physical-memory evidence because it can be collected only when the system is alive.

Abstract

from arXiv · show

The demand for cloud computing is increasing because of the popularity of digital devices and the wide use of the Internet. Among cloud computing services, most consumers use cloud storage services that provide mass storage. This is because these services give them various additional functions as well as storage. It is easy to access cloud storage services using smartphones. With increasing utilization, it is possible for malicious users to abuse cloud storage services. Therefore, a study on digital forensic investigation of cloud storage services is necessary. This paper proposes new procedure for investigating and analyzing the artifacts of all accessible devices, such as Windows, Mac, iPhone, and Android smartphone.

1. Introduction

Cloud storage services offer virtual space and additional functions, but their growing use creates forensic challenges because server logs may be inaccessible and user activity leaves complementary traces across local devices. This paper therefore presents methods for collecting and analyzing cloud-storage evidence from PCs and smartphones.

  • Background: Cloud storage, a type of IaaS, provides virtual space for documents, images, and music while offering additional functions beyond storage.
  • Motivation: The expanding use of cloud services raises security concerns after a hacker used Amazon’s EC2 cloud space to attack Sony’s PlayStation Network, motivating cloud-computing forensics.The incident indicated that crimes using other cloud services were also likely as adoption increased.
  • Problem: Investigating cloud storage is difficult because reconstructing a user’s activity from subscription through service termination is hindered when providers withhold server logs to protect personal information.The paper consequently describes where use traces exist on local PCs and smartphones and how to analyze them.
  • Related work: Prior work identified Dropbox traces in Windows installation directories, registry changes, network activity, databases, logs, and uninstallation data, but did not explain their investigative use.McClain also noted smartphone access without elaborating on the data available for investigation.
  • Contribution: The paper examines complementary traces on PCs and smartphones, arguing that all devices accessing one user’s cloud storage should be investigated.It presents methods for collecting and analyzing evidence from a variety of currently available cloud storage services.

2. Cloud Storage Services and Digital Forensics

Cloud storage services combine mass storage with additional functions and cross-platform access, creating distinct forensic artifacts across PCs and smartphones. The paper selects four representative services and proposes a device-to-cloud investigation procedure incorporating artifact analysis and legal authorization.

  • Cloud Storage Services: Cloud storage services provide storage plus functions such as document and image editing, media playback, and email, and are accessible through browsers and multi-platform client applications.Providers commonly offer free storage, with additional capacity available for lease.
  • Cloud Storage Services: The study examines Amazon S3, Dropbox, Google Docs, and Evernote, representing storage, office-and-storage, and note-and-storage service types.The selections reflect service popularity and differentiation, with detailed criteria listed in Table 1.
  • Investigation Procedure: Investigators collect and analyze artifacts from PCs and smartphones, using volatile-memory acquisition when possible and otherwise examining browser history, logs, files, and directories.The procedure covers Windows, Mac, iPhone, and Android devices, although the paper focuses on PCs and smartphones; Android acquisition requires rooting.
  • Investigation Procedure: After identifying cloud-service traces and credentials, investigators must obtain a search and seizure warrant before accessing private cloud storage; jurisdiction determines whether international judicial assistance is required.If only an ID is found, investigators assess whether the provider’s server is under the same jurisdiction before collecting stored files.
  • Investigation Procedure: Following legal proceedings, investigators analyze remote-cloud data and local-device artifacts, then document the completed investigation in a report.The procedure analyzes cloud-storage contents to support collection and interpretation of data in remote storage.
  • Investigation Procedure: Physical memory may contain browser login IDs and passwords but can be collected only from a live system, so the paper does not focus on it.This limitation applies despite the procedure recommending memory acquisition when possible.

3. Artifacts of Cloud Storage Services (Windows and Mac)

This section describes artifacts left on Windows and Mac systems after customers use cloud storage services, with Table 4 documenting the services and application versions studied.

  • 3. Artifacts of Cloud Storage Services (Windows and Mac): The study examines artifacts left on Windows and Mac systems after cloud storage service use.The artifacts are analyzed after a customer has used a cloud storage service.
  • 3. Artifacts of Cloud Storage Services (Windows and Mac): Table 4 lists the cloud storage services and application versions studied.

3.1 Amazon S3

Amazon S3 supports cross-platform cloud storage through APIs, but investigations must account for temporary Internet files and browser-specific artifacts. Internet Explorer exposes bucket-log evidence, whereas Firefox requires general browser forensic analysis and artifact recovery.

  • 3.1 Amazon S3: Amazon S3 provides APIs for uploading, downloading, opening, and deleting files across Windows, Mac, iPhone, and Android devices.Although SSL is enabled by default, temporary Internet files are still created.
  • 3.1 Amazon S3: Internet Explorer creates shortcut and temporary text artifacts when users download or open Office files and browse bucket logs.Bucket logging is disabled by default; when enabled, logs are delivered to a bucket log.
  • 3.1 Amazon S3: Bucket-log temporary files record the canonical ID, bucket name, action time, user action, acted-on filename, and HTTP user-agent value [17].The fields are positioned as the first, second, third, seventh, eighth, and last fields, respectively.
  • 3.1 Amazon S3: Firefox investigations require analyzing visited URLs, visit times, and cache contents because Amazon S3 leaves no special evidence and browser artifacts disappear when closed.Deleted artifacts can be restored with tools such as EnCase.

3.2 Dropbox

Dropbox forensic artifacts are stored in SQLite databases on Windows, while Mac artifacts are similar but located at different paths. These artifacts reveal recent file activity, account and installation information, and synchronized-file timestamps and paths.

  • Windows artifacts: Windows Dropbox creates five database files, with config.db and filecache.db providing important, readily identifiable SQLite artifacts.The files are created in paths listed in Appendix A.
  • Windows artifacts: config.db records the five most recently edited, copied, moved, or deleted files, with the most recently accessed file listed first.Its recently_changed3 key identifies files the user accessed.
  • Windows artifacts: config.db contains the login email and Dropbox installation path, enabling investigators to access the suspect’s cloud storage by relocating the database to a matching installation path.The procedure involves collecting config.db, installing Dropbox on the investigator’s PC, and placing the database in the suspect’s dropbox_path.
  • Windows artifacts: filecache.db stores synchronized-file names and server paths together with creation and modification times represented as Unix time.These artifacts support reconstruction of file timing and server location.
  • Mac artifacts: Mac Dropbox artifacts are similar to Windows artifacts but are stored at different paths.The relevant Mac paths are listed in Appendix B.

3.3 Evernote

Evernote synchronizes notes across Windows, Mac, iPhone, and Android devices, creating platform-specific artifacts for forensic analysis[14]. Windows artifacts reveal note metadata, revision history, and application activity, while Mac files provide corresponding note and log information.

  • 3.3 Evernote: Evernote supports access from Windows, Mac, iPhone, and Android smartphones and synchronizes notes whenever they are saved[14].
  • Windows artifacts: Windows creates four folders, with SQLite database and text log files providing readily identifiable forensic contents.
  • Windows artifacts: The [userID].exb database records note titles, creation and modification times, creation locations, source smartphone operating systems, and attached-file metadata.Table 8 identifies the [userID].exb database artifact.
  • Windows artifacts: The [userID].exb.thumbnails file stores PNG snapshots from each synchronization, enabling reconstruction of note revision history.Figure 3 illustrates the stored PNG sequence after its 24-byte header is excluded.
  • Windows artifacts: Windows log files record authentication, account ID, application start and end times, and daily application-start activity.AppLog_[Date].txt records authentication information, the account ID, and start and end times; enclipper_[Date].txt records application-start time.
  • Mac artifacts: Mac creates Evernote.sql, fullscreenThumbnail.png, thumbnail.png, and Evernote.log, corresponding to Windows note data, snapshots, note text, and application logs.Evernote.sql is SQLite; fullscreenThumbnail.png snapshots notes; thumbnail.png contains note text; Evernote.log corresponds to AppLog_[Date].txt.

3.4 Google Docs

Google Docs supports web and mobile document access, sharing, uploading, downloading, and editing, but creates Internet temporary files despite default SSL. The investigation identifies browser- and behavior-dependent artifacts on Windows and Mac, including recoverable files deleted when the browser closes.

  • Google Docs supports web and mobile access, file sharing and revocation, uploading, downloading, and editing, while still creating Internet temporary files despite default SSL.
  • Internet Explorer on Windows: Internet Explorer 8.0 on Windows creates behavior-dependent temporary artifacts for Google Docs, including document listings, document or presentation contents, spreadsheets, and PDF views.The artifact patterns are documented in Table 9.
  • Artifact recovery: Google Docs artifacts are deleted when the web browser closes but can be restored with a forensic tool such as EnCase.
  • Firefox on Mac: Firefox 9.0.1 on Mac creates behavior-dependent temporary artifacts, including PNG and HTML files for presentations, PDFs, and edited Office documents.Table 10 documents these Firefox artifacts; HTML files may contain Google Docs-related keywords and signatures.

4. Artifacts of Cloud Storage Services (Smartphones) · 4.1 iOS

The study examines cloud-storage artifacts on iPhone 4 and identifies service-specific files recording credentials, access activity, synchronization, content, and deletion-related events. iOS artifacts from Amazon S3, Dropbox, Evernote, and iGoogDocs reveal account information and user actions, including written file contents.

  • 4. Artifacts of Cloud Storage Services (Smartphones): Experiments examined cloud-storage artifacts on an iPhone 4 running iOS 4.3.5 and a Motorola Droid running Android 2.2.2.The smartphone study focused on two widely used devices.
  • 4.1.1 Amazon S3: Amazon S3 generated a plist containing the user name, access key ID, and secret access key, plus an SQLite database recording downloaded-file paths, names, sizes, eTags, times, and bucket names.The DOWNLOADS table stores these download attributes and the S3BUCKET value identifies the bucket.
  • 4.1.2 Dropbox: Dropbox artifacts include a plist with the login email address and first login time, while SQLite databases record browsed and uploaded file paths, names, and absolute times.Dropbox.sqlite records accessed folders or files; Upload.sqlite records uploaded files.
  • 4.1.3 Evernote: Evernote artifacts include usage logs, account identifiers, synchronization data, connection status, note contents, and timestamps for file access, modification, browsing, deletion, and synchronization.The artifacts also preserve sequential note indexes, recycle-bin movement times, and the latest synchronization time.
  • 4.1.3 Evernote: Evernote’s missing sequential index numbers indicate deleted notes, which are moved to a recycle bin retaining the time of movement.Deleted-note evidence is therefore recoverable through index gaps and recycle-bin timestamps.
  • 4.1.4 iGoogDocs: iGoogDocs stores an auto-login setting and, when enabled, user account information including the password in its plist file.The application also stores created text files under “Local Files.”
  • 4.1.4 iGoogDocs: The HTML file associated with iGoogDocs contains the text written by the user, allowing investigators to identify file content.The demonstrated file content appears under the “Local Files” folder.

4.2 Android

The Android investigation identifies application-specific artifacts generated by Amazon S3, Dropbox, Evernote, and Google Docs. These artifacts preserve credentials, account details, synchronization times, file or note metadata, and execution histories across XML, SQLite, and log files.

  • 4.2 Android: Amazon S3’s s3anywhere.xml stores the accessed bucket, credentials, directories, last synchronization time, and downloaded-file location on an external SD card.Bucket name, access key ID, and secret access key are especially important because they enable Amazon S3 access; encoded data uses base64 and times use Unix time.
  • 4.2 Android: Dropbox generates prefs.db, db.db, and log.txt containing login identity, uploaded-file metadata, installation information, and execution events.The log records login success or failure, service start and end, and synchronization, with timestamps represented as Unix time; downloaded files are stored externally.
  • 4.2 Android: Evernote.db records note titles, availability through the is_active flag, creation and update times, and the smartphone operating-system type.An is_active value of 1 means the note is available; other values indicate that it is unavailable.
  • 4.2 Android: Google Docs artifacts include account emails, synchronization times, file titles and types, and first-upload and last-modification times.DocList.db stores the account and file metadata, while GoodleDriveSharedPreferences.xml stores the administrator’s email and Webview.xml stores the latest connected email, helping distinguish users with multiple accounts.

5. Case Study of a Cloud Storage Service

The case study investigated whether Mr. K leaked Company A’s confidential design file by examining his PC and smartphone. Although the PC lacked direct leakage traces, combined Dropbox artifacts supported the conclusion that he leaked the file using Dropbox.

  • 5. Case Study of a Cloud Storage Service: The PC contained no leaked file, operating-system clues, external-device artifacts, or messenger and Web mail access traces during the relevant time window.The file system, including unallocated space, was examined, but the leaked file was not detected.
  • 5. Case Study of a Cloud Storage Service: Dropbox installation evidence on the PC led investigators to config.db, which listed five recently accessed files with random names, despite the suspect withholding account information.Investigators found evidence that Dropbox had been installed and pursued cloud-storage access through a search and seizure warrant.
  • 5. Case Study of a Cloud Storage Service: Rooted Android analysis found a log.txt record showing “abc.pdf” had been downloaded and stored on an external SD card.The smartphone examination supplemented the PC investigation with Dropbox-related artifacts.
  • 5. Case Study of a Cloud Storage Service: The investigation concluded that Mr. K leaked a confidential file using Dropbox, with combined PC and smartphone analysis enabling a more precise investigation.The objective was to determine whether Mr. K had leaked a secret file by investigating his PC and smartphone.

6. Discussion and Conclusions

The paper argues that cloud storage services require forensic investigation procedures because their accessibility enables abuse. It proposes a process model that extends examination beyond PCs to capture artifacts unavailable on those devices.

  • Cloud storage services’ easy accessibility and potential misuse make forensic investigation procedures necessary.
  • PC-only examinations are inadequate because relevant cloud-storage artifacts may not remain on the computer.
  • The paper proposes a process model for forensic investigation of cloud storage services and identifies important investigation elements.

Appendix A. Artifacts of Cloud Storage Service (Windows)

The Windows artifacts include temporary Internet files, authentication and access records, synchronization and deletion indicators, and cached document or PDF content. Together, these artifacts capture both cloud-storage activity and recoverable file contents.

  • Windows artifacts: Temporary Internet Files preserve cloud-service traces, including requested APIs, request times, and accessed bucket names.These artifacts are associated with user requests and accessed storage locations.
  • Windows artifacts: Windows artifacts record login information, recently accessed files, synchronized file names and paths, and deletion flags.The records include up to five most recently accessed files.
  • Windows artifacts: Windows caches expose cloud-document data, including Google Docs file lists, MS Document contents, spreadsheet contents, and PDF text.The artifacts include docs_google_com[n].htm, MS document and spreadsheet contents, and viewer[n].xml containing PDF text.
  • Windows artifacts: Cached presentation, text, and PDF files can also retain rendered or edited views, including PDF page images and document snapshots.The listed artifacts include viewer[n].png for PDF pages and first-page or edited-file representations.
Loading 1709.10395v1…