Overcast: Forensic Discovery in Cloud Environments

Abstract

While best practices and standards are emerging, supported by advances in research, for forensic investigations in individual computer systems and networks, new challenges are arising, which threaten to more than make up for the ground gained by investigators and researchers. In this paper we review some of the challenges posed by the increasingly common use of highly distributed and complex systems in a number of environments and attempt to outline a research agenda for investigations potentially spanning multiple jurisdictions, large numbers of distributed systems and services, and stretching out over extended periods of time, noting that — despite a strong focus on core areas of computer science and mathematics — there is an inherent strong need for interdisciplinary work linking the requirements and concepts of evidence arising from the legal field to what can be feasibly reconstructed and inferred algorithmically or in an exploratory manner.