Digital Forensics: A Case Study on Workplace Crime and Cloud-Based Forensics

This paper analyzes a practical case of workplace crime using tools available in the sub-branch of digital forensics that is network forensics. It also provides a report-based theoretical analysis on cloud-based forensics. The case study involves a covert email conversation between suspected Spectre agents and their plan to acquire information from Mr. Whyte through his secretary Ms. Case. The paper provides a detailed chain of events and timeline of the communication between the suspects and their victims.

Contents
Executive Summary.................................................................................................................. 2
Task 1..................................................................................................................................... 2
Introduction............................................................................................................................. 2
Chain of Events........................................................................................................................ 4
Tasks....................................................................................................................................... 8
Detailed Map of the suspects and their victims...........................................................................12
Timeline of events.................................................................................................................. 14
Task 2................................................................................................................................... 14
Introduction........................................................................................................................... 14
Previous Research................................................................................................................... 15
New Digital Forensics Project..................................................................................................17
Conclusion............................................................................................................................. 18
References............................................................................................................................. 20

Executive Summary
Due to the increasing proliferation of technology since the middle 20th century as well as the
eventual importance of this technology in the conduct of criminal activity, the field of digital
forensics has become commonplace. The proof is usually visible in conventional forensics,
which could distinguish the suspect, such as skin, saliva, including fingerprints. Digital
forensics, on the other hand, deals with electronically processed data and information from
digital devices. Digital forensic science is a widely used term for identifying, collecting and
analyzing digital evidence from much more than just devices like smartphones, laptops, the
Internet of Things or perhaps even data which are deposited in the cloud. Network forensic
science is a sub-branch of digital forensics related to computer network traffic surveillance as
well as analysis for information collection, legal documentation, including intrusion detection
applications. In this paper, a practical case of workplace crime is analyzed and solved using
tools available in the sub-branch of digital forensics that is network forensics. Further ahead
in the paper, a report-based theoretical analysis on cloud-based forensics is also provided.
Task 1
Introduction
Steps used to carry out the investigation using the primary tool of investigation Wireshark:
● To begin with, several hundred packets were analyzed earlier in an attempt to uncover
the essence of what was going on.
● Upon analyzing, it was clear that the relevant packets were that of the Email protocol
where the essence of the case was.
● As a result, all of the email packets were intercepted and analyzed which then helped
frame the below mentioned chain of events.
● For this to happen, the latest version of Wireshark was used on Windows and step-by-
step each of the Email packets were intercepted and analyzed. The chain of events is
depicted further into the report below.
● Further ahead, network miner was used to help intercept all the files in the packet
capture. It further helped in categorizing different file types and placed it in different
sections.
● Without, Network miner, it would have been very difficult to carve the file as
removing the header information from the captured packets in order to isolate the DD

and PCap file was quite difficult. Therefore, networkminer sped the task here and
helped isolate the two important files being secret.pcap and trash.dd.

Chain of Events
Email thread - Fortunate News (Between Mr. Kidd and Mr. Wint)
 The very first exchange between the spectre agents took place on Tuesday, the
12th of September, 2017. The timing for the exchange was at 9.11.22 am. This
exchange took place between the spectre agents known as Mr. Kidd and Mr.

Wint. The message was sent by Mr. Kidd and the recipient being Mr. Fint. The
message was sent from Evolution mail client which is at version 3.22 and was
developed by the GNOME and is part of the Linux environment. The
message’s subject was ‘Fortunate News’ which indicates that Mr. Kidd was
bringing up some critical development updates to Mr. Fint. The message
contained a message that said that Mr. Kidd has found or perhaps intercepted a
file transfer sent by Mr. Whyte who at this point is an unknown entity as to
whether he is a part of Spectre or something else. Also, the relationship with
the other two Spectre agents are unknown at this point. The message said that
the file has been intercepted by Mr. Kidd and that the file had come from
slumber.inc.
 A follow-up reply was done by the Spectre agent Mr. Wint who approved of
the message and praised Mr. Kidd. This follow-up reply was sent by Mr. Wint
to Mr. Kidd by 9.14.47 am of the same day which is 12th September, 2017
and was within 3 minutes of the first message being sent. The message
specifically said that Mr. Wint was curious as to whether the file that had been
intercepted by Mr. Kidd had been the ‘one’ that they were after. This means
that, both of these Spectre agents were specifically after some information
involving Mr. Whyte and Slumber.inc and that this file interception could
have been that.
 A follow-up reply was done by the Spectre agent Mr. Kidd who initially broke
the fortunate news to Mr. Wint. This message was a bit of disapproval. This
message was sent by Mr. Kidd to Mr. Wint by 9.18 which is again within 3 to
4 minutes of the previous reply by Mr. Wint. The message said that the file
intercepted by Mr. Kidd was encrypted and that it needs a key to decode or
analyze it. The message further said that the file would then be sent by Mr.
Kidd to Mr. Wint so that he can see if he can do anything about it.
Simultaneously, in the same conversation email Mr. Kidd had attached the file
as an attachment. This file was named as ‘secret.pcap’ indicating that this was
perhaps a packet capture of Mr. Whyte’s internet traffic.

 Another follow-up reply was done in the same email thread by Mr. Wint. This
reply was sent by Mr. Wint to Mr. Kidd at 9.34 on the very same day from the
same email client. In this reply from Mr. Wint to Mr. Kidd, he specified that
even if the Packet capture is encrypted and perhaps there was no way to
decrypt it, there might be an alternative method of acquiring their intended
information through another way. He further goes on to say that Mr. Whyte’s
secretary who is known as Ms. Case, might just be able to get the information
from Mr. Whyte by accessing his Trash directory. This means, that the two
spectre agents are after an information which is known or possessed by Mr.
Whyte and that since the Packet Capture method did not turn out the way they
expected, they opted for an alternative involving his secretary Ms. Case who
might manually help them retrieve that information from Mr. Whyte’s trash
directory.
 A follow-up reply was done in the same email thread by Mr. Kidd to Mr. Wint
This reply was sent to Mr. Wint by Mr. Kidd at 9.38 am on the same day via
the same email client. In this reply from Mr. Kidd, he said that he might be
knowing Ms. Case which was not made clear as to professionally, personally
or otherwise. He questioned Mr. Wint on how to proceed with Ms. Case and
whether to persuade her in revealing the information they desired or via some
other method.

 Another follow-up reply was done in the same email thread. This reply was
sent at 9.56 am. The reply was sent by Mr. Wint to Mr. Kidd. Based on the
previous conversation, Mr. Kidd has asked Mr. Wint on how to persuade Ms.
Case to reveal the information they were after from Mr. Whyte. So now, Mr.
Wint had come up with an idea. In this email, Mr. Wint, reveals that there was
a memory dump of Ms. Case’s computer while she was working at the office
and was perhaps doing something personal, un-professional, unethical or
illegal. This memory dump was found by Mr. Wint and it could be used to
expose the activity of Ms. Case which would get Ms. Case in trouble. Now,
this memory dump was kept at Slumber.inc and Mr. Wint instructed to see this
memory dump and use that as leverage against Ms. Case to pursue her to do
what these two Spectre agents were after.
 A simple follow-up reply was done in the same email thread by Mr. Kidd to
Mr. Wint at 10.42 am using the same email client. In this email, Mr. Kidd
thanked Mr. Wint of helping him with this information which could help them
both use Ms. Case to carry out their ulterior motives. This conversation ended
here, indicating that Mr. Kidd might continue with the plan.
 A new email was sent by Mr. Kidd to Mr. Wint at around 11.26 am. This
email was sent on the very same email thread which was originally titled
‘Fortunate News’. This email by Mr. Kidd revealed that he had found the
information sent by Mr. Wint to be useful and that he has now what he needs.
This implies that, in the previous email that was sent by Mr. Kidd to Mr. Wint
at 10.42 am, Mr. Wint had told him that there was a secret information that
could be used as a leverage point against Ms. Case. So, it essentially proves
that the leverage against Ms. Case was successful and that the image of trash
directory sent by Ms. Case as a result of using that leverage had also proved to
be exactly what they were after.
Email Thread - Request for Assistance (Between Mr. Smith and Ms. Case)
 A new email was sent by Mr. Smith to Ms. Case on the very same day that is
Tuesday, the 12th of September, 2017 at 10.47 am. This message was sent by Mr.
Smith using the same email client and within 5 minutes of the previous conversation
between Mr. Kidd and Mr. Wint wherein they decided to take up the matter with Ms.
Case. The email was sent with a subject as ‘Request for Assistance’ and the message
said that Mr. Smith was from the IT department at the Whytehouse and that he was

looking for Ms. Case’s assistance. For the same, Mr. Smith had requested Ms. Case to
take an ‘image’ of Mr. Whyte’s trash directory and send it to him.
 An immediate reply was given by Ms. Case to Mr. Smith on the very same email
thread on the very same day after a few minutes at 10.53 am. The reply said that, she
was aware that Mr. Smith was not from the same IT Department and that this ‘Social
Engineering’ tactic that Mr. Smith tried to pull off with Ms. Case did not work. Ms.
Case therefore showed hesitation and reluctance in doing the task she was asked to
do.
 A follow-up reply was sent by Mr. Smith to Ms. Case on the same email thread on the
same day at 10.58 am and it said that Mr. Smith insisted on handling this matter in
civilized manner. He said that he was aware of Ms. Case doing something that she
was not supposed to be doing and that too during working hours of the company. He
further specified that she was doing it again in the same morning and that he would
tell on her to Mr. Whyte regarding the same.
 A follow-up reply was sent by Ms. Case to Mr. Smith on the previous email thread
titled ‘Request for Assistance’ and this email is sent at 11.14 am. In this email thread,
Ms. Case proceeds to send Mr. Smith a file attachment named ‘trash.dd’ which
indicates that Ms. Case had given into the demands of Mr. Smith. This means that,
Ms. Case had eventually given Mr. Smith a disk file copy of Mr. Whyte’s trash
directory.
Email Thread - Pool Party

 A new email was initiated by Ms. Case to Mr. Whyte on the same day at 11.06 am
which was around 7 minutes after their email conversation with Mr. Smith. The
subject was titled as ‘Pool Party Update’ and it mentioned something about two
people arriving for the mountain retreat. The email also mentioned about some people
called as Bambi and Thumper.
 A follow-up reply was sent by Mr. Whyte to Ms. Case immediately by 11.09 am on
the same day and email thread. The message instructed Ms. Case to cancel Mr.
Whyte’s all afternoon meetings.
Tasks
1. What was the first communication between the suspected SPECTRE agents?
The very first communication took place on September 12th, 2017. This was an email
conversation and it took place between Mr. Wint and Mr. Kidd as being the two suspected
Spectre agents. It was sent by Mr. Kidd to Mr. Wint and it was sent at 9.11 in the morning.
2. What did the suspected SPECTRE agents exchange?
The two spectre agents being Mr. Kidd and Mr. Wint were exchanging conversations over
Emails in the morning of September 12trh, 2017. Their conversation was covert type. Mr.
Kidd and Mr. Wint began talking about having the good news wherein they had intercepted
some conversation from Mr. Whyte. This communication was captured in a packet capture
file. They further continued having this conversation over several emails wherein it was
revealed that they would eventually make use of Ms. Case who works at Whytehouse and is a
secretary to Mr. Whyte. Their plan was to either hoodwink or blackmail her into sending
them a file which was from Mr. Whyte. They planned and executed this operation over
several emails and ultimately leading to success in the end when Ms. Case finally give into
their demands and eventually send them the requested file.
3. What was used to blackmail Tiffany Case?
It was not made completely clear as to what was used to Blackmail Ms. Case. However, Mr.
Smith on his Email to Ms. Case on 12th September, 2017. The very first mail by Mr. Smith at
10.47 used a social engineering tactic wherein Mr. Smith claimed to work in the same
organization as that of Ms. Case. In this social engineering tactic, Mr. Smith further claimed
that he worked in the IT department and that he needed the image file of the trash directory of

Mr. Whyte in order to debug some errors in the system they were having. This was a made-
up story that was conceived to deceive Ms. Case, however, Ms. Case’s alertness and
vigilance proved helpful here and she was able to prevent Mr. Smith’s social engineering
attack. Later on, however, Mr. Smith came up with another plan wherein he figured out that
there was a memory dump of Ms. Case’s computer and they knew what she was doing during
the company’s time. This was discussed between Mr. Wint and Mr. Kidd in the 9.56 am
Email that was exchanged between them. Mr. Smith, then used this information to blackmail
her in a follow-up email at 10.58 am. In the final email sent by Ms. Case to Mr. Smith, it can
be observed that, she finally had acquired the image file and sent it to Mr. Smith in the email
timed 11.14 am.
Who is Putter Smith?
Mr. Smith very first appeared in the packet capture when he sent the first Email to Ms. Case
asking for Assistance using the aforementioned social engineering tactic. He was trying to
hoodwink Ms. Case by telling her he was from the same company and their IT Department.
The very first email which was with the subject line - ‘Request for Assistance’ was sent to
Ms. Case at 10.47 am. Prior to that, 5 minutes ago, between Mr. Wint and Mr. Kidd wherein
Mr. Kidd had revealed that he has some information that can be used as a leverage point
against Ms. Case. Right after that in 5 minutes, the email was sent to Ms. Case titled ‘Request
for Assistance’ wherein Mr. Smith used a social engineering tactic on her. Upon failing that,
Mr. Smith quickly retorted to sending another email wherein he blackmailed her of having an
information against her wherein she was doing something during company’s official working
hours. Ms. Case sent the requested file to Mr. Smith at around 11.14 am and 12 minutes post
that, Mr. Kidd sent an email to Mr. Wint wherein he said that he had what they needed. So,
this implies that there is a possibility that Mr. Kidd is Mr. Smith wherein Mr. Smith is just a
Pseudonym or Alias used by Mr. Kidd to carry out their ulterior motives. This deduction,
further becomes a probability that Mr. Kidd is Mr. Smith because both of the email addresses
typically originate from the IP address - 10.165.148.127.

What mail client does Putter Smith use?
Mr. Smith or as deduced earlier, Mr. Kidd uses Gnome Evolution email ID which is at
version 3.22.6-1. Gnome Evolution runs on Linux environment predominantly and is the
same version and email client used by Mr. Kidd as well as his alias Mr. Smith.

What was the operating system running on Tiffany Case’s PC?
Ms. Case is the secretary of Mr. Whyte at Whytehouse and is first introduced properly in the
Packet Capture chain of events when she receives an email from Mr. Smith with the subject
line - Request for Assistance sent at 10.47 am. The operating system running on Ms. Case’s
PC is Ubuntu OS.
What was Tiffany Case looking at that she shouldn’t be?
Ms. Case is introduced first in the chain of events of packet capture is in the 4th email
exchange between Mr. Wint and Mr. Kidd wherein Mr. Wint reveals that he has some
information on Ms. Case acquired through her PC’s memory dump wherein she was looking
at something during company hours which she shouldn’t be. The nature of the activity is not
disclosed by the two anywhere and is neither mentioned by Ms. Case. Also, at the same time,
it is also not made clear as to whether it was a highly illegal activity being done by Ms. Case.
This goes on to conclude that perhaps she was looking at something she wasn’t supposed to
during company hours. This means, that it could be anything such as being on personal Social
Media, Personal Email, watching videos for entertainment and so on. However, it would be
against the company policy to do so, which might’ve gotten her startled which eventually led
her to give into the demands of Mr. Smith or Mr. Kidd.
What was in the trash directory?
The trash.dd file was first introduced in Packet Capture chain of events in the fourth email
being discussed between Mr. Kidd and Mr. Wint wherein they mentioned about accessing
Mr. Whyte’s directory. As a result, through the eventual course of action and because of the
well-executed plan, they find Mr. Whyte’s trash directory image. Upon examining this image
file, it was found that it has ext4 file extension indicating that it originated from a Linux
based operating system. Further ahead, the file image contains the following list of files:
a) .journal file b) Inode c) secret.key d) secret.pcap (deleted file). The secret.key file when
viewed with text editor, shows SSL/TLS encrypted records of website visits. This is the same
key file that Mr. Kidd had mentioned to Mr. Wint that they needed to decode the encrypted
transfer of Mr. Whyte.
In order to see what was in the trash directory, FTK Imager as well as WINHex was used.
The FTK imager helped in mounting the image file into Windows directory. Post this,
WinHex was used to read the image file mounted. However, it won’t read the logical volume

and thereafter it was only able to access the physical disk when mounted on a virtual drive
letter under Windows. All files were retrievable, however the secret.cap file was
unrecoverable.
What was in the encrypted transfer by Willard Whyte?
The very first time the mention about the encrypted transfer is broken during the chain of
events is the beginning of the email itself. The very first email sent by Mr. Kidd to Mr. Wint
is when the news is broken. This email is titled ‘Fortunate News’ and this is when the Mr.
Kidd mentions about the encrypted file transfer. The encrypted file transfer that they are
talking about is the secret.pcap which is supposedly the packet capture of Mr. Willard
Whyte’s internet traffic. Analyzing the packet capture in Wireshark reveals that Mr. Whyte’s
internet traffic is centered around TCP and TLS protocols. Further investigation reveals that,
most of the Mr. Whyte’s visits are to www.slumber.inc on encrypted internet routing.
Is Willard Whyte working for SPECTRE?
No Willard Whyte is not working for SPECTRE. This is evident from the fact that there were
no direct linkages of Willard Whyte. Mr. Whyte is the boss of Ms. Case and the head of
Whytehouse. On the other hand, the Spectre.lab could be an organization directly or
indirectly associated with Whytehouse of whose agents Mr. Wint and Mr. Kidd are trying to
spy on Mr. Whyte.

Detailed Map of the suspects and their victims
Timeline of events
Emails
From to Whom Time Thread Brief
Mr. Kidd to Mr.
Wint
9.11 am Fortunate News Mr. Kidd had
intercepted a file
from Mr. Whyte and
was letting Mr. Wint
know
Mr. Wint to Mr.
Kidd
9.14 am Fortunate News Mr. Wint enquired if
the intercepted file
was the ‘one’
Mr. Kidd to Mr.
Wint
9.18 am Fortunate News Mr. Kidd said the
file needs a ‘key’ to
decode it.
Mr. Wint to Mr.
Kidd
9.34 am Fortunate News - Mr. Wint
mentioned using Ms.
Case to retrieve the
Mr. Wint
Email: mr-
[e-mail]
IP: 10.165.148.70
Hostname:
UnknownMAC:
B67F745B6020
Mr. Kidd
Email: [e-mail]
IP: 10.165.148.127
Hostname: UnknownMAC:
B67F745B6020
Mr. Smith
Email: putter-
[e-mail]
IP: 10.165.148.127
Hostname: UnknownMAC:
B67F745B6020
Mr. Whyte
Email: [e-mail]
IP: 192.168.22.16
Hostname: UnknownMAC:
16C118D96129 Ms. Case
Email: tiffany-
[e-mail]
IP: 192.168.22.16
Hostname: Unknown
MAC: B67F745B6020Spectre Whytehouse

‘key’
Mr. Kidd to Mr.
Wint
9.38 am Fortunate News Mr. Kidd enquired
how to use Ms. Case
for giving the key.
Mr. Wint to Mr.
Kidd
9.56 am Fortunate News Mr. Wint mentioned
using Ms. Case
recently acquired
memory dump into
blackmailing her.
Mr. Kidd to Mr.
Wint
10.42 am Fortunate News Mr. Kidd thanked
Mr. Wint for the
information on Ms.
Case.
Mr. Smith to Ms.
Case
10.47 am Request for
Assistance
Mr. Smith asked for
Ms. Case assistance
in helping him
provide Mr. Whyte’s
image of Trash
directory.
Ms. Case to Mr.
Smith
10.53 am Request for
Assistance
Ms. Case found a
foul play and said no
to the assistance.
Mr. Smith to Ms.
Case
10.58 am Request for
Assistance
Mr. Smith
blackmailed Ms.
Case using her
memory dump.
Ms. Case to Mr.
Whyte
11.06 am Pool Party update Ms. Case updated
Mr. Whyte on the
Pool Party and
arrival of two
people.
Mr. Whyte to Ms.
Case
11.09 am Pool Party update Mr. Whyte asked
Ms. Case to cancel
his afternoon

meetings.
Mr. Whyte to Ms.
Case
11.14 am Request for
Assistance
Ms. Case sent the
trash directory
image file of Mr.
Whyte to Mr. Smith.
Mr. Kidd to Mr.
Wint at 11.26 am
11.26 am Fortunate News Mr. Kidd mentioned
that he has now
acquired the ‘trash’
directory image file
Task 2
Introduction
The cloud forensics is one of the most popular disciplines, which provides an integration
between cloud computing and the digital forensics. The cloud forensics is concerned with the
application using the digital forensics, that is responsible for monitoring the crime, which is
committed over the cloud network and performs relevant investigation on it (Ho, Kao & Wu,
018). Most of the companies have transferred their most critical data over the cloud service
providers because of security concerns. This enables them to quickly respond to several

crucial events, including legal issues such as lawsuits and law enforcement. In cloud
environment, the data transformation takes place globally, even by crossing the international
borders.
Cloud forensics is concerned with the integration of digital forensics information over the
cloud platform (Ho, Kao & Wu, 018). These include the combination of various computing
resources such as storages, network assets, servers, applications and others. In these cases, the
environment generally remains constant and can be reconfigured quickly with least effort.
This report would discuss about the previous research of cloud forensics and a good forensic
software which has been introduced in the last few years.
Previous Research
According to Zawoad and Hasan (2016), the public cloud service has reached $131 billion in
2019, which has increased significantly in the past few years. Pichan, Lazarescu and Soh
(2015) opines that cloud computing is considered as one of the most important steps in the
information technology services. There are several cloud service providers (CSP) which offer
several transformative changes in the different computing activities, which are directly
related to the cloud security. The CSP’s do not let their clients see the actual functioning of
the clouds. There are many functioning of the clouds such as multi-tenancy, data duplication,
identification and separation of the digital forensics. The findings of Nanda and Hansen
(2016) reveal that digital forensics is becoming extremely challenging due to several reasons
such as highly distributed IT systems, which comes under multiple jurisdictions. There are
also issues with data handling as well as lack of computing services, especially in a
computing environment. These reasons cause obstacles in the digital investigations and it also
becomes quite time-consuming and more expensive. It is believed that cloud computing is
able to solve these issues, however, it lacks architectural level of support. The cloud service
providers are unable to provide solutions for these challenges by giving forensic tools on the
Software-as-a-Service (SaaS) (Ho, Kao & Wu, 018). However, a new type of cloud
architecture known as Forensics-as-a-Service (FaaS) is being able to introduce a new level of
the forensic support, from the various cloud service providers. The customers and the cloud
service providers are to define the forensic capabilities, which would support the
investigation of the concerned crime.
In order to understand the dynamics of cloud forensics, it is important to understand the three
dimensions such as legal, organizational and technical. The technical dimension is considered

with the tools which are required for performing the various forensic investigation in various
cloud computing environment. These types of tools include the various data collection tools,
evidence segregation, live forensics, proactive measures and the virtualised environment
(Irfan et al., 2016). The data included the facts which are located in the infrastructure, which
is located among the providers as well as the data which is stored in the customers end. The
organizational dimension is considered with the cloud consumer as well as cloud service
provider. It is expected that the cloud service provider should communicate with the third
parties regarding their expertise with the investigation. They may be required to hire IT
professionals who are experts in networks, systems, ethical hacking, cloud security and
others, who would assist the various investigators in the different crime scenes. There are
incident handlers, who respond to the data loss, denial of service attacks, insider attacks, and
breach of confidentiality. On the other hand, the legal dimension is concerned with the
different types of agreements as well as regulations, which are needed for ensuring the
forensic activities, which do not breach the legal jurisdictions (Ho, Kao & Wu, 018). A
service level agreement (SLA) is done between the users of the cloud and the cloud service
providers, which defines different guidelines that are used in detecting the ongoing forensic
investigations (Dubey et al., 2018). There are several guidelines between cloud users and the
CSP, such as the access, service and the techniques should be provided to the customers
during the process of investigation. It is also important to trust the boundaries, responsibilities
as well as roles between the CSP and the customers, which should not be violated.
Martini, Do and Choo (2015) argues that there are growing instances of mobile cloud
forensics and they have an intricate relationship with the different popular Android
applications. The findings of Alex, M. E., & Kishore, R. (2017 () reveal that there is
significant popularity of the cloud computing, which has risen over the years and which can
be allocated to the users on demand. There has been an increasing use of the cloud computing
services for performing different fraudulent activities by the cyber-criminals. Roussev et al.
(2016) opines that cloud forensics is considered as an effective tool for future outlook as well
as development studies. The cloud forensics is assumed as a qualitatively varied problem and
in the various context of SaaS, it is not compatible with the different long-established
acquisition as well as analysis techniques, which requires new approach as well as forensic
toolset. The study uses the kumoodd-a tool for the purpose of cloud drive acquisition and the
kumodocs-a tool for the purpose of acquisition of Google Docs and screening for the
different cloud drive data. These tools work in both public as well as private API of the
different service providers and providing new capabilities which cannot be achieved with the

help of examining client-side artifacts. Daryabar, Dehghantanha and Choo (2017) argues that
the increasing use of smartphones as well as cloud storage has allowed the customers to
access their data from any location and according to their convenient time. The mobile
devices have the potential of being targeted by the criminals and hence they are increasing
used in the cloud forensics investigation process. The increasing use of smartphones as well
as cloud storage has allowed the customers to access their data from any location and
according to their convenient time (Ho, Kao & Wu, 018). The mobile devices have the
potential of being targeted by the criminals and hence they act as a vital source of evidence in
investigations involving traditional crimes as well as cybercrimes.
The different user activities like uploading, login and deletion in the cloud client application
such as Google Drive can be recovered forensically, which helps in the understanding of
different dynamics of cloud storage forensics. Patidar and Bansal (2015) explores that it is
important to track digital crimes as well as increasing security threats given over cloud
environment and the implementation of systematic forensics methodology. The cloud
forensic helps in recovering of evidence in the event of any cybercrime and the investigations
related to the particular committed crime. However, the cloud evidences need adequate
authentication, so that any unknown entry in the system can be prevented. The various
credentials such as ID, password and other cached credentials, should be used carefully, in
order to track the crimes committed over the cloud (Patidar & Bansal, 2015). The rapid
elasticity is considered to be one of the most important characteristics of cloud forensics,
which includes the large number of live forensic tools as well as other forensics
infrastructure.
As opined by Rittinghouse and Ransome (2017), the concept of security in cloud computing
services is important emphasizes the need for cloud-based antivirus solutions for the purpose
of forensic computing. The different security centres are altering their delivery methods so
that they can include the cloud services. The forensics could be used in cloud service by
leveraging the huge computing power of the cloud services. In the public cloud environment,
the confidential data is being accessed by the third parties and the unable to decide the
location of the data (Patidar & Bansal, 2015). Hence, in order to apply forms of cloud, it is
important to implement data encryption.

New Digital Forensics Project
Magnet Forensics is considered as a global leader in the manufacturing and implementation
of different digital installation software, smartphones, computer applications and others. The
company has launched AXIOM mobile as well as AXIOM computer, which would help in
the combining of various kinds of digital evidence from multiple sources of information and
put it in the same file come containing complete case details such as discovery, analysis and
sharing. The AXIOM Cloud uses a two-factor authentication, which is considered as an
additional security, that protects the user accounts along with protecting their username and
password (Riadi et al., 2018). This software has unique collaboration capabilities, which
ensures that the entire case along with the findings can be sent to the broader stakeholders for
getting their valuable comments and review. This software does not only retrieve the digital
information from popular services but it also helps in the analysis of the data which is
recovered.
There is several potentially vital information, which are stored in the cloud such as enterprise
documents, application data, IoT devices and others (Patel et al., 2017,). The software owners
are aware of the fact that there is requirement of lawful access as well as examination of data
required in several investigations. The users of this software able to extract the evidences
respective of file types such as .doc or .pdf and others. It is also important to extract the
important data from social media networks and with the different cloud services. The
software data from multiple social media networks such as one drive, office 365, Twitter,
Instagram and Google services. Magnet AXIOM helps in every stage of the digital
investigation process right from imaging drives as well as data processing as well as data
recovery.
Recommendations
Cloud forensic systems must be a combination of the existing methods of static and live
selection as well as analysis, and that they need information to identify and predict
forensic objects based on heuristics. The collection approach is the only factor of incidents
where conventional forensic methods match. In incidents where retrieval is an obstacle,
forensic technologies of the next generation need to interpret the locations of physical as well
as logical evidence. Visualization should display both obtainable as well as unobtainable
objects, relieving the pressure of collection and estimates of conservation. In an automated
fashion, unobtainable objects must be annotated as such, and the annotations must be

evidence brought into the evidence presented. Cloud forensic applications must use the cloud
as a discovery engine for precise forensic judgments in relation to visualization. Forensic
collections comprising unrecoverable objects should be uploaded for heuristic and signature-
based review in a cloud based environment. As amount of submissions grows, it uses a form
identical to antivirus engines enabling forensic experts to turn partial collections into usable
presentations.
Conclusion
The cloud forensics is one of the most important concepts in the modern world, which is
helpful for the investigators to track the malicious activities of the cyber criminals. The cloud
forensics are important for analysing the different kinds of risks correctly and protect the
sensitive organizational data from being intruded by the third parties. The Magnet Forensics
has launched the AXIOM Cloud, which is one of the best cloud forensic software, which is
being used in modern times. The modern-day companies have heavy investments on the
cloud computing and cloud forensics. This paper would help in better dynamics of various
attributes of cloud forensics and how it can be useful for the organizations for the
organizational betterment.

References
Alex, M. E., & Kishore, R. (2017). Forensics framework for cloud computing. Computers &
Electrical Engineering, 60, 193-205.
Daryabar, F., Dehghantanha, A., & Choo, K. K. R. (2017). Cloud storage forensics: MEGA
as a case study. Australian Journal of Forensic Sciences, 49(3), 344-357.
Dubey, P., Tiwari, V., Chawla, S., & Chauhan, V. (2018). Authentication Framework for
Cloud Machine Deletion. In Information and Communication Technology for
Sustainable Development (pp. 199-206). Springer, Singapore.
Ho, S. M., Kao, D., & Wu, W. Y. (2018). Following the breadcrumbs: Timestamp pattern
identification for cloud forensics. Digital Investigation, 24, 79-94.
Irfan, M., Abbas, H., Sun, Y., Sajid, A., & Pasha, M. (2016). A framework for cloud
forensics evidence collection and analysis using security information and event
management. Security and Communication Networks, 9(16), 3790-3807.
Manoj, S. K. A., & Bhaskari, D. L. (2016). Cloud forensics-a framework for investigating
cyber attacks in cloud environment. Procedia Computer Science, 85, 149-154.
Martini, B., Do, Q., & Choo, K. K. R. (2015). Mobile cloud forensics: An analysis of seven
popular Android apps. arXiv preprint arXiv:1506.05533.
Nanda, S., & Hansen, R. A. (2016, July). Forensics as a service: Three-tier architecture for
cloud based forensic analysis. In 2016 15th International Symposium on Parallel and
Distributed Computing (ISPDC) (pp. 178-183). IEEE.
Patel, P., Kannoorpatti, K., Shanmugam, B., Azam, S., & Yeo, K. C. (2017, January). A
theoretical review of social media usage by cyber-criminals. In 2017 International
Conference on Computer Communication and Informatics (ICCCI) (pp. 1-6). IEEE.
Patidar, M., & Bansal, P. (2018). Cloud Forensics: An Overall Research
Perspective. International Journal of Scientific Research in Network Security and
Communication, 6(2), 5-10.
Pichan, A., Lazarescu, M., & Soh, S. T. (2015). Cloud forensics: Technical challenges,
solutions and comparative analysis. Digital investigation, 13, 38-57.
Riadi, I., Yudhana, A., Caesar, M., & Putra, F. (2018). Forensic Tool Comparison on
Instagram Digital Evidence Based on Android with The NIST Method. Sci. J.
Informatics, 5(2), 235-247.

Rittinghouse, J. W., & Ransome, J. F. (2017). Cloud computing: implementation,
management, and security. CRC press.
Roussev, V., Ahmed, I., Barreto, A., McCulley, S., & Shanmughan, V. (2016). Cloud
forensics–Tool development studies & future outlook. Digital investigation, 18, 79-
95.
Zawoad, S., & Hasan, R. (2016). Trustworthy digital forensics in the cloud. Computer, 49(3),
78-81.