Video Resources and Questions

The present video resources and questions are designed to support learners in appreciating or considering the different challenges and opportunities that emerge for forensic investigations in the shift from investigating single systems to distributed systems.

The questions are organised in relation to material present in the CyBOK.

Questions

Logical Acquisition

Do we think the process exhibited in many of the clips is still applicable to an investigation involving cloud computing?

For example: We observed a number of individuals directly with systems attempting to extract remnants or copies of data? Is that true of cloud computing? Where computation and its outcome may pass between a number of end-points and/or services?

Authoritative Data Source

Reflecting on the video(s), we observed actions where the individual is likely extract the authoritative data from the system. Do we think that is true of many systems involving cloud computing?

For example: Do we think we would have a good copy of a document, if the document was produced using a Software-as-a-Service (SaaS), such as Google Docs, instead of the native client of a word processor on a system, such as Microsoft Word?

Pervasive Logging

Reflecting on the video(s), we observed some individual deducing what had happened from observing the system and data rather than having concrete information. Do we think the situation may improve with investigations involving cloud computing given the pervasive logging present in cloud computing.

For example: Cloud computing involves multiple elements and these interactions are extensively logged. An aspect of cloud computing that present data for investigates to assess what actually happened rather than deduce it.

Distributed Computation

Reflecting on the video(s), we observed traditional actions to conduct traditional investigations, such as executing a tool or copying a segment of data. Do we think these approaches and tools will transition to investigations involving cloud computing?

For example: Cloud computing is distributed across a number of elements rather than a single system. It is not clear, if many, if not most, of the common tools and tactics to conduct digital investigations will work effectively in the context of cloud computing.