I Have the Proof: Providing Proofs of Past Data Possession in Cloud Forensics

TL;DR

This paper introduces a scheme to prove past data possession in cloud storage, addressing forensic challenges by enabling verification of previous data presence despite the cloud's opaque and multi-tenant nature.

Contribution

It proposes a novel method for generating proofs of past data possession in cloud environments, enhancing forensic capabilities beyond current data analysis.

Findings

The scheme effectively proves past data possession in real cloud settings.

Performance evaluation shows the scheme is practical and efficient.

Discussion highlights its application in cloud forensic investigations.

Abstract

Cloud computing has emerged as a popular computing paradigm in recent years. However, today's cloud computing architectures often lack support for computer forensic investigations. A key task of digital forensics is to prove the presence of a particular file in a given storage system. Unfortunately, it is very hard to do so in a cloud given the black-box nature of clouds and the multi-tenant cloud models. In clouds, analyzing the data from a virtual machine instance or data stored in a cloud storage only allows us to investigate the current content of the cloud storage, but not the previous contents. In this paper, we introduce the idea of building proofs of past data possession in the context of a cloud storage service. We present a scheme for creating such proofs and evaluate its performance in a real cloud provider. We also discuss how this proof of past data possession can be used effectively in cloud forensics.