Usability of Cloud-Based Applications in Digital Forensics: An Experimental Study on Image Acquisition and Digital Evidence Preservation Processes

Abstract

While cloud computing’s dynamic structure brings significant conveniences and access to information from anywhere in our professional and personal lives, this same dynamic structure also provides certain advantages in the field of digital forensics. Cloud forensics differs from traditional digital forensics in some physical and technical aspects. The physical and technical differences of cloud services have introduced new dimensions to the legal field, particularly concerning the concept of electronic evidence, its collection, ensuring its admissibility in court, and conducting these processes through scientific methods. As part of the study, the image acquisition process, which constitutes the first response to digital evidence, was performed by creating physical copies from external storage devices. Access to data stored in the cloud can be obtained by activating mutual legal assistance agreements, collecting user information with consent, and utilizing indicators and user information gathered during electronic evidence examinations. For testing purposes, a user account was created through Gmail’s online drive, and certain user activities were conducted to enable data uploads to the accounts. To conduct examinations, a physical image of a Kingston DataTraveler G4 USB Device flash drive was obtained using the AccessData FTK Imager software.The purpose of this study is to create a preservation model that experts using cloud computing storage services, as a developing subfield of digital forensics, should follow during the image acquisition process the first response to digital evidence and its preservation during the analysis process. The digital evidence image acquisition processes within cloud storage services are presented as examples.