What's Next, Cloud? A Forensic Framework for Analyzing Self-Hosted Cloud Storage Solutions

TL;DR

This paper presents a new forensic framework for analyzing self-hosted cloud storage solutions like Nextcloud, emphasizing structured evidence collection through native APIs and device monitoring to improve investigation reliability.

Contribution

It introduces an extended forensic framework that incorporates device monitoring and cloud API integration, specifically tailored for self-hosted cloud platforms like Nextcloud.

Findings

Demonstrated how Nextcloud's APIs can be used for evidence acquisition

Developed an open-source tool for forensic data collection

Enhanced forensic analysis capabilities for self-hosted cloud storage

Abstract

Self-hosted cloud storage platforms like Nextcloud are gaining popularity among individuals and organizations seeking greater control over their data. However, this shift introduces new challenges for digital forensic investigations, particularly in systematically analyzing both client and server components. Despite Nextcloud's widespread use, it has received limited attention in forensic research. In this work, we critically examine existing cloud storage forensic frameworks and highlight their limitations. To address the gaps, we propose an extended forensic framework that incorporates device monitoring and leverages cloud APIs for structured, repeatable evidence acquisition. Using Nextcloud as a case study, we demonstrate how its native APIs can be used to reliably access forensic artifacts, and we introduce an open-source acquisition tool that implements this approach. Our framework equips investigators with a more flexible method for analyzing self-hosted cloud storage systems, and offers a foundation for further development in this evolving area of digital forensics.