Internati
o
nal
Journal of Ele
c
trical
and Computer
Engineering
(IJE
CE)
V
o
l.
6, N
o
. 5
,
O
c
tob
e
r
201
6, p
p
. 2
387
~239
5
I
S
SN
: 208
8-8
7
0
8
,
D
O
I
:
10.115
91
/ij
ece.v6
i
5.1
152
7
2
387
Jo
urn
a
l
h
o
me
pa
ge
: h
ttp
://iaesjo
u
r
na
l.com/
o
n
lin
e/ind
e
x.ph
p
/
IJECE
Inves
t
igation on the Services
of Private Cloud Computing by
Using ADAM Method
Nur Widiyas
o
no
1
, Imam Riadi
2
, Ahm
a
d
Luthfi
3
1
Departement of
Informatics
,
Siliwangi University
, Indonesia
2
Departement of
Information
S
y
s
t
ems,
Ahmad Dahlan Univ
ersity
,
Indonesia
3
Department
of I
n
formatics, Indo
ne
sia Islamic Un
iversity
, Indon
esia
Article Info
A
B
STRAC
T
Article histo
r
y:
Received
J
u
n 13, 2016
Rev
i
sed
Au
g
19
, 20
16
Accepte
d
Se
p 7, 2016
Cloud services are offer
e
d b
y
man
y
cloud ser
v
ice provid
e
rs, but most
companies generally
build a private
cloud computing. Cloud s
y
s
t
ems abuse
can be don
e b
y
internal users or
due to
misconfig
uration or may
also refer to
the weaknesses in the s
y
stem.
This
study
evaluated ADAM
(Advanced Data
Acquisition Model) method. R
e
ferring to
th
e results of the investigation
process b
y
usin
g ADAM
Method, it
can b
e
verified
that
ther
e are sev
e
ral
param
e
ters of
th
e success inv
e
sti
g
ation;
ther
efore
the inv
e
stiga
tio
n b
y
using
ADAM can be s
u
ccesed
proper
l
y and
correctly
.
Another con
t
rib
u
tion of
this
stud
y
was
to i
d
entif
y
the
we
aknesses of th
e
servic
e s
y
s
t
em
that
used
owncloud in us
ers list of th
e
same
group can change anoth
e
r’s user’s
password.
Keyword:
AD
AM
Clo
ud
Ev
alu
a
tion
Forensic
Inv
e
stig
ation
Copyright ©
201
6 Institut
e
o
f
Ad
vanced
Engin
eer
ing and S
c
i
e
nce.
All rights re
se
rve
d
.
Co
rresp
ond
i
ng
Autho
r
:
Im
am
Riadi
Ah
m
a
d
Dah
l
an Un
iv
ersity
Jl
. Pr
of
.
Dr
. S
o
epom
o, Ja
nt
u
r
a
n
,
Y
ogy
a
k
art
a
55
1
6
4
Em
a
il: i
m
a
m
.ri
a
d
i
@is.u
a
d.ac.id
.
1.
INTRODUCTION
C
l
ou
d com
put
i
ng i
s
a t
ech
n
o
l
o
gy
services
that are offe
red by th
e
cloud
service provide
r
(CSP),
am
ong
ot
her t
y
pes o
f
deal
s
pl
at
fo
rm
as
a service
(PaaS
),
infra
struct
ure
a
s
a service (Ia
a
S) a
n
d softwa
re as a
service
(Saa
S). This se
rvice
p
r
o
v
i
d
es
a
wi
de
ran
g
e
o
f
faci
l
i
t
i
e
s and
be
nefi
t
s
fo
r c
o
n
s
um
ers, am
on
g
ot
he
rs, i
s
t
h
e pr
o
v
i
s
i
o
n o
f
sel
f-se
r
vi
ce,
el
ast
i
c
i
t
y
,
and
pay
per
use. C
l
ou
d ser
v
i
ces a
r
e di
vi
ded i
n
t
o
fo
ur
part
s i
n
cl
udi
ng
p
r
i
v
ate clou
d,
p
u
b
lic cloud
,
pu
b
lic cloud
and
h
ybr
id
cl
o
u
d
[
1
].
Priv
ate clou
d
is b
u
ilt to
th
e n
eed
s
o
f
o
r
gan
i
zatio
n
s
th
at
in
clu
d
e
th
e en
tire clo
u
d
infrastru
c
tu
re
i
n
cl
udi
ng
har
d
ware
res
o
urce
s o
w
ned
by
t
h
e
or
ga
ni
zat
i
on. C
o
m
m
uni
t
y
cl
ou
d
i
s
a c
l
ou
d t
h
at
i
s
use
d
co
llectiv
ely b
y
o
r
g
a
n
i
zation
s
th
at h
a
v
e
th
e sa
m
e
t
y
p
e
o
f
busin
ess. Pu
b
lic Clo
u
d
is th
e cl
o
u
d
th
at was bu
ilt an
d
use
d
by
t
h
e Or
ga
ni
zat
i
on
pu
bl
i
c
l
y
t
o
hi
s busi
n
ess i
n
t
e
rest
s. Hy
bri
d
C
l
oud i
s
a com
b
i
n
at
i
on o
f
pri
v
at
e
,
com
m
uni
t
y
and
pu
bl
i
c
cl
o
u
d
[2]
.
C
l
ou
d servi
ces
offe
red i
n
cl
u
d
e h
o
st
ed de
s
k
t
o
p i
s
a vi
rt
u
a
l
m
achi
n
e on
a cl
oud. T
h
i
s
servi
ce has
applications a
n
d data t
h
at resi
de on a
rem
o
te data
cente
r.
The
owne
r of
this service ca
n access a
p
plications
and
dat
a
vi
a co
m
put
er deskt
o
p. Thi
s
deskt
o
p h
o
st
ed ser
v
i
c
e can be ab
use
d
t
o
com
m
i
t
cyber cri
m
e [3]
.
Ab
use
of
t
h
is
service can
also occ
u
r due
t
o
the pres
ence of flaw
s
(b
ug
s) fro
m
th
e sid
e
of th
e
secu
rity o
f
th
e syste
m
.
Acco
r
d
i
n
g t
o
NIS
T
, t
h
e st
a
g
es on cl
ou
d c
o
m
put
i
ng f
o
re
n
s
ics is th
e id
en
tificatio
n
,
co
l
l
ectio
n
,
preserv
a
tio
n,
ex
am
in
atio
n
,
i
n
terp
retation
an
d repo
rting
o
f
d
i
g
ital ev
id
ence [4
].
Th
e
h
a
nd
ling
o
f
cy
b
e
r crim
e
tech
n
i
q
u
e
s req
u
i
red
t
h
e acqu
isitio
n
o
f
d
a
ta, wh
ere th
e
d
a
ta acqu
i
sitio
n
tech
n
i
qu
e can
b
e
do
n
e
o
n
a liv
e syste
m
o
r
write-b
lo
ck
syste
m
[5
-7
]. The seco
nd
d
a
ta
acq
u
i
sition
tech
n
i
q
u
e
s
ar
e no
t on
ly do
n
e
cl
ou
d
co
mp
u
ting
serv
ices, bu
t can
also
b
e
don
e
o
n
t
h
e clien
t
co
m
p
u
t
er
, ser
v
er
,
no
tebook
an
d
a sm
artp
ho
n
e
. Liv
e
d
a
ta acq
u
i
sition
pro
cess syst
em
mean
s th
e process for g
e
tting
a d
i
g
ital p
r
oo
f i
s
Evaluation Warning : The document was created with Spire.PDF for Python.
I
S
SN
:
2
088
-87
08
I
J
ECE
Vo
l. 6
,
N
o
. 5
,
O
c
tob
e
r
20
16
:
238
7
–
23
95
2
388
carried
ou
t when
th
e system
i
s
in
a State o
f
life wh
ile th
e
write b
l
o
c
k
system is th
e d
a
ta acq
u
i
sition
pro
c
ess is
done
when the
syste
m
is in a
State of deat
h
for exam
pl
e t
h
e
p
r
oces
s
of ac
q
u
i
s
i
t
i
on
of
dat
a
o
n
t
h
e
ha
r
d
dri
v
e.
Process
data acquisition doe
s
cloud c
o
m
puting
serv
ices can be t
r
eated the sam
e
because
of the
charact
e
r
i
s
t
i
c
s of t
h
ose ser
v
i
c
es i
s
not
t
h
e sam
e
[8]
.
The so
l
u
t
i
on gi
ve
n i
n
t
h
e pr
obl
em
of cl
ou
d f
o
re
nsi
c
s i
s
utilized by the
logging fram
e
w
ork. It is
use
d
to e
n
sure that the l
og
data
was successfully collected can be
use
d
f
o
r
fo
ren
s
i
c
i
nvest
i
g
at
i
o
n p
r
o
cess [
9
]
.
There a
r
e se
ve
ral
m
e
t
hods
o
f
fere
d, am
ong
o
t
hers,
by
t
h
e m
e
t
h
o
d
of
ADAM
(T
he Adva
nce Data Acquisitions Model).
T
h
is
m
e
thod
was
de
veloped t
o
address t
h
e
problem
with
in
t
h
e framewo
r
k
o
f
d
a
t
a
reab
ilita
s how th
e ev
iden
ce was
ob
tain
ed
b
y
d
i
g
ital d
a
ta an
d
t
h
is
will b
e
of
part
i
c
ul
a
r
co
n
cern i
n
t
h
e
C
o
u
n
ci
l
but
un
f
o
rt
u
n
at
el
y
AD
AM
m
e
t
hod
has ne
ver
do
ne an ev
al
uat
i
o
n
i
nde
pen
d
e
n
t
l
y
[1
0]
.
C
l
ou
d C
o
m
put
i
ng i
s
t
h
e a
p
pl
i
cat
i
on o
f
F
o
re
nsi
c
Sc
ien
ce
d
i
g
ital fo
ren
s
ics
wh
ich
is clou
d co
m
p
u
ting
envi
ro
nm
ent
,
and t
e
c
hni
cal
l
y
con
duct
e
d f
o
re
nsi
c
ap
pr
oa
ch co
nsi
s
t
i
n
g
of a
hy
bri
d
su
ch as rem
o
t
e
, vi
rt
ual
,
net
w
or
k, l
i
v
e, t
h
i
n
-cl
i
e
nt
agai
nst
di
gi
t
a
l
evi
d
ence an
d or
ga
n
i
zat
i
onal
l
y
i
nvol
ve
d t
h
e i
n
t
e
r
act
i
on bet
w
ee
n
act
or
clo
u
d
co
m
p
u
tin
g fo
r in
tern
al
and
ex
tern
al i
n
v
e
stig
atio
n
s
,
as well as leg
a
lly i
m
p
l
y
m
u
lt
ip
le-ju
r
isd
i
ction
and
m
u
l
tip
le-ten
an
t
situ
atio
n [1
1
]
.
A repo
rt fro
m
th
e Nation
a
l Institu
te o
f
Stand
a
rd
s an
d
Tech
no
log
y
no
ted
th
at th
e Gu
id
e
to
ob
tain
ing
and
pe
rf
orm
i
ng f
o
re
nsi
c
s
on
cl
ou
d com
put
i
ng
ser
v
i
ces an
d s
u
g
g
est
e
d t
h
at
gui
d
e
l
i
n
es a
r
e t
h
e
best
t
h
er
e i
s
and
still applies to do a digital fore
nsics in cloud c
o
m
pu
ting envi
ronm
ent
[12]. Digita
l forensics m
e
thods that
ex
ist, it is no
t su
itab
l
e fo
r cloud
co
m
p
u
tin
g
en
v
i
ron
m
en
t [13
]
.
The
gui
del
i
n
es
on t
h
e col
l
ect
i
on
of
di
gi
t
a
l
evi
d
e
n
ce are a
l
ready scarce a
nd
outdated. T
h
ere a
r
e
no
speci
fi
c g
u
i
d
el
i
n
es fo
r col
l
e
c
t
i
ng di
gi
t
a
l
evi
d
ence
o
n
C
l
ou
d C
o
m
put
i
ng
[
14]
, [
1
5]
, [
16]
,[
17]
. T
h
e rese
arch
found on this little cloud com
puting, su
c
h
as how to retri
e
ve data from
the cloud service in fore
nsic voic
e
[1
8]
.
Si
m
ilar
o
b
s
ervatio
n
s
were und
ertak
e
n
b
y
a n
u
m
b
e
r
o
f
d
i
gital fo
ren
s
ic practitio
n
e
rs, i
n
clu
d
i
ng
t
h
e
Di
rect
o
r
of t
h
e
US
De
part
m
e
nt
of
De
fense
C
o
m
put
er F
o
re
n
s
i
c
s Lab
o
rat
o
r
y
and
C
h
i
e
f
Sc
i
e
nt
i
s
t
at
t
h
e U
.
S.
Ai
r
Force Researc
h
La
boratory Inform
ation Di
rectorat
wh
ich sug
g
e
sts th
at
"research is req
u
i
red in
t
h
e cyb
e
r
dom
ai
n, especi
al
l
y
i
n
cl
oud c
o
m
put
i
ng, t
o
c
o
n
d
u
ct
t
h
e i
d
e
n
t
i
f
i
cat
i
on a
n
d
cl
assi
fi
cat
i
on
of t
h
e u
n
i
q
ue a
s
pect
s
of
doi
ng
whe
r
e and
ho
w di
gi
t
a
l
evi
d
ence ca
n be f
o
un
d. T
h
e end
poi
nt
of
suc
h
m
obi
l
e
devi
ces al
so i
n
c
r
eases
the com
p
lexity of this
dom
ain. T
r
ace e
v
ide
n
ce ca
n be
fo
und on the
servers, s
w
itche
s
,
routers
,
cell phones
,
and
ot
hers
[
1
9]
,[
20]
.
Th
e leg
a
l
p
o
i
n
t
of
v
i
ew
, th
e syste
m
o
f
cloud co
m
p
u
ting
h
a
s th
e
po
ten
tial
f
o
r
h
i
gh
lev
e
ls
o
f
d
i
ff
icu
lty
doi
ng
f
o
re
nsi
c
com
put
er a
n
al
y
s
i
s
pr
ocess as
wel
l
as t
o
obt
ai
n an
d
per
f
o
r
m
anal
y
s
i
s
of
di
gi
t
a
l
evi
d
e
n
c
e
wi
t
h
th
e sam
e
stan
dard as in trad
itio
n
a
l
serv
er syste
m
s [2
1
]
. It
is du
e to th
e d
i
fficu
lty in
estab
l
ish
i
ng
d
a
ta stored or
p
r
o
cessed
b
y
sp
ecial so
f
t
w
a
r
e
. Th
e stag
e of
"Co
llectio
n
"
beco
m
e
s a
m
u
c
h
m
o
r
e
co
m
p
li
cated
p
r
o
cess in
cl
oud
co
m
p
u
tin
g
environ
m
en
ts d
u
e
to
th
e ph
ysical lo
catio
n of
th
e d
a
ta, th
e distrib
u
tion
o
f
d
a
ta acro
s
s mu
ltip
le
serve
r
s o
r
st
o
r
a
g
e devi
ces
an
d ju
ri
sdi
c
t
i
o
n,
an
d ot
he
rs [2
2]
, [
23]
.
Research
cond
u
c
ted
in
th
e NIST
Fram
ework, d
i
scu
s
ses th
e id
en
tifi
catio
n
(i
d
e
n
tificatio
n
)
an
d
prese
r
vat
i
on
(
p
rese
r
v
at
i
o
n
)
as part
o
f
t
h
e
phase
of c
o
l
l
ect
i
on (C
ol
l
e
ct
i
on) s
o
t
h
at
i
t
i
ndi
cat
es that
t
h
e
id
en
tificatio
n
p
h
a
se in
clou
d co
m
p
u
tin
g
is
m
o
re i
m
p
o
r
tant, w
h
er
eas ph
ase p
r
eserv
a
tio
n sh
ou
ld
wo
rk
clo
s
ely
with
cloud
serv
ice
p
r
ov
id
ers, bo
th step
s are im
p
o
r
tant in
inv
e
stig
atio
n
o
n
clou
d co
m
p
u
tin
g.
Ph
ase
id
en
tificatio
n
an
d preserv
a
ti
o
n
ph
ase
are
the s
o
urce
of t
h
e e
v
ide
n
ces t
h
at
m
u
st be si
m
u
ltaneously and as
q
u
i
ck
ly as p
o
ssib
le. For ex
am
p
l
e
if th
e d
a
ta so
urce alre
ady id
en
tified
,
then
it sh
ou
ld
immed
i
ately co
n
t
act th
e
cl
ou
d se
rvi
ce
p
r
o
v
i
d
e
r
t
o
be
gi
n t
h
e
p
r
ese
r
vat
i
on.
Th
e
ro
le
o
f
artifacts (e.g
. m
e
tad
a
ta) in fo
ren
s
i
c
an
alysis and
(pro
sp
ectiv
e) i
s
lo
ss
o
f
t
h
is artifact wh
en
dat
a
col
l
ect
ed
fr
om
t
h
e cl
oud
com
put
i
ng e
n
vi
r
onm
ent
.
If t
h
e m
e
t
a
dat
a
(e.g. c
r
eat
i
o
n/
m
o
di
fi
cat
i
on
dat
e
of a
file, and
l
o
g th
e
u
s
er's own
e
rsh
i
p
)
t
h
at is l
o
st during
th
e p
r
o
cess of collectin
g
.
It i
n
fl
u
e
n
c
es th
e ab
i
lity o
f
researc
h
ers to
conduct a
fore
nsic investigati
o
n to
t
h
e stan
dar
d
s r
e
qu
ir
ed by th
e cour
t [2
4].
Di
gi
t
a
l
f
o
re
nsi
c
s p
r
oce
ss ca
n
be
di
vi
de
d i
n
t
o
f
o
u
r
di
st
i
n
ct
, t
h
ey
are:
[1]
Collection of
artifacts (both
digital a
nd m
a
terial evidence
of the accompli
ce) that is c
onsi
d
ere
d
to have
p
o
t
en
tial v
a
lu
e to
co
llected
.
[2]
Prese
r
vation
of the
ori
g
inal a
r
tifacts in a
way
that
is reliable, com
p
lete, accurate, and
veri
fiable.
[3]
An
alysis
o
f
art
i
fact filterin
g
to
elimin
ate o
r
en
try o
f
go
od
s th
at
are
con
s
idered
v
a
l
u
ab
le.
[4]
Prese
n
tation
where
evi
d
ence
is prese
n
ted
t
o
su
ppo
rt t
h
e inv
e
stig
atio
n
o
f
.
Trad
ition
a
lly, th
ere are two
categ
o
ries o
f
d
i
g
ital fo
re
n
s
ics th
ere-t
h
ey
are, sta
tic d
i
g
ital/write "b
lo
ck
"
an
d "liv
e fro
m", in
wh
ich
these two catego
r
ies
b
e
co
m
e
a resu
lt o
f
th
e evo
l
u
tion
o
f
fo
ren
s
ic sp
ecialists to
create and
doc
u
m
e
nt incident
s in s
o
phisticated.
Evaluation Warning : The document was created with Spire.PDF for Python.
I
J
ECE
I
S
SN
:
208
8-8
7
0
8
Invest
i
g
at
i
o
n
o
n
t
h
e
Se
rvi
ces
of
Pri
v
at
e C
l
o
u
d
C
o
mp
ut
i
n
g
by
Usi
n
g A
D
A
M
Met
h
o
d
(
N
u
r
Wi
di
ya
so
n
o
)
2
389
2.
R
E
SEARC
H M
ETHOD
Pro
cess fl
o
w
st
ages of re
se
arch can
be descri
bed i
n
Fi
gu
re 1. P
r
e
v
i
o
us resea
r
ch
st
udi
es are
co
ndu
cted
t
o
k
now th
e
p
r
ob
lem
s
th
at ex
ist in
th
e
p
r
oc
ess of investigating cloud com
puting servi
ces are
main
ly related
to
th
e acqu
isitio
n pro
c
ess
d
a
ta clo
u
d
co
m
p
utin
g
serv
ice, the m
e
th
o
d
s used
to
m
a
k
e
th
e
p
r
o
cess
of
dat
a
acqui
si
t
i
on, as wel
l
a
s
t
h
e back
g
r
o
u
nd
behi
nd t
h
e i
ssues be
hi
n
d
AD
AM
'
S
m
e
tho
d
s, s
o
t
h
at
i
t
can
sup
p
o
rt
o
n
t
h
e
ul
t
i
m
a
t
e
pur
po
se o
f
doi
ng
t
h
i
s
resea
r
ch
.
Fi
gu
re 1.
Rese
arch
proce
ss flow
Pre
p
arat
i
o
n sy
st
em
i
s
t
h
e stage b
u
i
l
d
i
n
g of t
h
e p
r
i
v
at
e
cl
oud c
o
m
put
i
ng ser
v
i
ces by
usi
n
g a
Micr
o
s
o
f
t W
i
n
dow
s op
er
atin
g
syst
em
platform
2008 Adva
nces
s
e
rve
r
, Virt
ualMachine (VMware
)
,
OwnCloud-5.0.5 Serve
r
by
providi
ng ip
public then
this pri
v
ate cloud services
can
be
accessed through the
internet, as
we
ll as local networks
and hotspots
.
This se
rvice can also
be accessed by
using the pc
-desktop,
not
e
b
o
o
k
or
a s
m
art
p
h
one
,
wh
i
l
e
t
h
e net
w
o
r
k
t
o
p
o
l
o
gy
as
sh
ow
n i
n
Fi
gu
re
2.
Figure 2.
Conc
eptual Access Service
Pri
v
ate
Cloud
Case stud
ies are
u
s
ed
in th
e sim
u
lat
i
o
n
o
f
th
e co
m
p
u
t
er n
e
t
w
ork in the labo
ratory is th
e case
of
h
o
s
p
ital in
Tasik
m
a
l
aya to
wn wh
o
s
e
n
a
m
e
i
s
cam
o
u
f
lag
e
d
in
to
XYZ
h
o
s
pital. Th
is case
is an
ex
am
p
l
e o
f
the
o
ccurren
ce
o
f
ab
use b
y
an
em
p
l
o
y
ee wh
o
leak
ed
secret th
ese co
m
p
an
ies to
th
e co
m
p
etito
r. Dig
ital Priv
ate
Inv
e
stig
ator
h
a
s a d
u
t
y to
g
e
t th
e d
i
g
ital ev
i
d
en
ce t
h
at v
e
ry p
o
t
en
tial when
it is o
n
th
e sid
e
of th
e priv
ate
cloud se
rvices, des
k
top
PC
or Sm
artphones
that
us
e t
h
e s
u
spect.
Knowing by
eve
r
y e
m
ployee incom
p
any
XYZ ho
sp
ital can
use th
is
p
r
i
v
ate clou
d
service facilities so
th
at it is p
o
ssi
b
l
e to
ab
u
s
e the facility o
ccu
rred
t
o
d
i
vu
lg
e co
m
p
an
y secrets to
it
s co
m
p
etito
rs.
In
vest
i
g
at
i
o
n i
n
t
o
t
h
e case
sim
u
l
a
t
i
on usi
ng t
h
e ser
v
i
ces of pri
v
at
e cl
oud c
o
m
put
i
n
g. T
h
e
i
nvest
i
g
at
i
o
n
was c
o
n
d
u
ct
ed
be
gi
n
n
i
n
g o
n
pri
v
at
e cl
o
ud c
o
m
put
i
ng se
r
v
i
ce or
f
r
om
t
h
e serve
r
si
de, t
h
e
n
f
r
o
m
th
e sid
e
i.e. m
o
n
itoring
n
e
two
r
k
again
s
t d
a
ta traffic ex
itin
g
/
en
tering
in
t
o
priv
ate cloud
co
m
p
u
ting
serv
ice
serv
er an
d g
e
t
th
e d
i
g
ital evid
en
ce sessions in
layer
(lay
er
5
O
S
I 7
lay
e
rs) Usi
ng Wi
resha
r
ks or Ne
two
r
k
Evaluation Warning : The document was created with Spire.PDF for Python.
I
S
SN
:
2
088
-87
08
I
J
ECE
Vo
l. 6
,
N
o
. 5
,
O
c
tob
e
r
20
16
:
238
7
–
23
95
2
390
M
i
nner t
o
ol
, t
h
en a
n
i
nve
st
i
g
at
i
on a
g
ai
nst
des
k
t
o
ps o
r
n
o
t
ebo
ok a
nd Sm
art
p
ho
nes co
n
n
ect
ed on t
h
e servi
ces
i
s
do
ne
.
A
ben
c
hm
ark of s
u
c
cess i
n
per
f
o
r
m
i
ng t
h
e i
nves
t
i
g
at
i
on i
s
abl
e
t
o
kn
ow t
h
e l
o
cat
i
on
or
po
si
t
i
on o
f
t
h
e di
gi
t
a
l
evi
d
ence ei
t
h
e
r
si
de p
r
i
v
at
e cl
ou
d ser
v
ers
,
des
k
t
op PC
s,
not
e
b
oo
k o
r
Sm
art
pho
nes
,
besi
de
s
ot
he
r
param
e
t
e
rs arei
p so
urce
, m
ac-ad
dre
ss, u
s
ernam
e
and p
a
ssw
or
d, l
o
g
dat
a
sy
st
em
s, can o
p
en t
h
e fi
l
e
encry
p
tion, and ot
her res
ources ca
n be
used as a
n
add
itio
n
a
l
d
i
g
ital ev
id
en
ce, t
h
en
th
e
d
i
g
ital
p
r
oo
f
veri
fi
cat
i
o
n a
n
d c
o
m
p
l
i
a
nce bet
w
ee
n
di
gi
t
a
l
evi
d
e
n
ce
f
o
u
n
d
o
n
t
h
e si
d
e
o
f
t
h
e
p
r
i
v
a
t
e cl
ou
d se
r
v
e
r
,
pc
des
k
t
o
ps, n
o
t
e
bo
o
k
s an
d Sm
art
p
ho
nes.
In
v
e
st
i
g
at
i
on o
n
t
h
i
s
case i
s
an exam
pl
e i
n
usi
ng t
h
e m
e
t
hod
of
AD
AM
(The
Ad
va
nce Dat
a
Acq
u
i
s
i
t
i
ons
M
odel
)
w
h
i
c
h
has 3
st
a
g
es,
t
h
ey
are:
a)
In
itial Plan
n
i
ng
: a sen
i
or investig
ato
r
an
d
t
h
e team sh
ou
ld
un
derstan
d
t
h
e task
o
r
th
e
case th
at will
b
e
faced t
h
at is they should
ha
ve
the capa
b
ility
of
details about com
put
er system
s/cloud syst
em
, the num
b
er
and
l
o
cat
i
o
n
of
dat
a
, t
h
e t
y
pe
of
ha
rd
di
s
k
a
n
d t
h
e
o
p
erat
i
n
g
sy
st
em
bei
ng
use
d
, t
h
e
ot
her
m
u
st
be abl
e
t
o
determ
ine the
ove
rall picture
about the case at hand,
determ
ine the desired end res
u
lts on the case
at
h
a
nd
,
d
e
term
in
e th
e p
a
ram
e
te
rs. Th
en
th
ere are so
m
e
wh
ich
m
u
st b
e
co
n
s
id
ered
v
i
z. th
e ex
isten
ce
of
constraints s
u
c
h
as
aut
h
orisa
tion
inte
rnally, externally, and legal
constraints phisik re
lated access t
o
p
r
op
erty
wh
ich
is t
h
e l
o
cation
o
f
m
a
n
y
related
tim
e
const
r
ai
nt
s, t
h
e
c
o
u
r
t
o
r
de
r a
g
ai
n
s
t
t
h
e
pr
ope
rt
y
b
y
pri
v
at
e or c
o
m
m
e
rci
a
l
,
i
.
e. da
t
a
const
r
ai
nt
t
y
pe an
d
nu
m
b
er of lo
cation
s
id
en
tified, so
th
at su
ch
th
ings
sho
u
l
d
be m
a
de as wel
l
as l
ogi
st
i
c
pl
an
ni
n
g
and
pre
p
ar
at
i
o
n are re
q
u
i
r
e
d
.
Sim
u
lation study on the case
of
t
h
i
s
st
udy
, a se
ni
o
r
i
nvest
i
g
at
or a
nd t
h
e t
e
a
m
m
u
st
unders
t
a
nd s
o
m
e
cases whi
c
h occ
u
r
r
ed i
n
t
h
e se
rvi
ce
of p
r
i
v
at
e
cl
o
u
d
c
o
m
put
i
ng b
y
m
a
ki
ng Am
eri
can
i
n
cl
u
d
ing form
in
g
teams th
at ha
ve
expertise as
stated
abo
v
e.
Som
e
of t
h
e sh
eet
s have
bee
n
pre
p
are
d
f
o
rm
signe
d
by
a sen
i
or i
n
vest
i
g
at
o
r
an
d t
h
e
r
eaft
e
r
co
ndu
cted
p
l
ann
i
ng
will b
e
u
n
d
e
rtak
en with resp
ect to th
e i
n
cid
e
n
ce
of litig
atio
n
.
b)
The On
Site Planni
ng:
the Second
Sta
g
e of
the pr
oces
s
,
i.e. whe
n
ADAM
m
e
thod is what
Gene
sis
matters th
en
t
h
e sen
i
or inv
e
stig
ato
r
and
the tea
m
m
a
d
e
a m
a
j
o
r acq
u
i
si
tio
n
p
l
an
, as t
h
is relates t
o
t
h
e
lo
catio
n
o
f
th
e d
a
ta, th
e size
an
d fo
rm
at o
f
th
e
d
a
ta. Safety con
cern
s
at the m
o
m
e
n
t
in
t
h
e scen
e
d
e
tails,
t
e
am
and pe
rs
o
nnel
dat
a
w
o
ul
d re
q
u
i
r
e eq
ui
p
m
ent
t
h
at
can
do t
h
e i
s
ol
at
i
o
n, acc
om
pani
ed by
a
n
u
p
d
at
e
or
maintain against the
docum
e
ntation
of all
the activities that
take
place (contem
porary records
of a
l
l
activ
ities), co
nd
u
c
ted
a p
r
elimin
ary su
rv
ey
to
ascertain
the lo
catio
n
o
f
t
h
e d
a
ta, d
e
termin
e th
e tech
n
i
cal
id
en
tities, and
d
e
fi
n
e
acqu
i
sitio
n
m
i
x
o
n
t
h
e scen
e th
i
n
g
s
or broug
h
t
t
o
the d
i
g
ital fo
ren
s
ic lab
o
r
at
o
r
ies.
The
n
perform
updates agai
ns
t the planni
ng
that will be
used on the ne
xt stage of t
h
e process m
e
thod
of
AD
AM
.
c)
Dig
ital Data
Acq
u
i
sition
:
th
e Th
ird
Stag
e
of th
e m
e
th
od
o
f
d
i
g
ital
d
a
ta acqu
i
sitio
n
ADAM is don
e
in
th
ese d
e
v
i
ces wh
ich
will b
e
d
o
n
e
on
th
e serv
er sid
e
d
a
ta
acq
u
i
sition
serv
ice p
r
i
v
ate clo
u
d
co
m
p
u
ting,
fr
om
t
h
e si
de
of t
h
e c
o
m
put
ers as
wel
l
as f
r
o
m
t
h
e si
de o
f
y
o
u
r
sm
art
p
h
one
de
vi
ce
use
d
by
t
h
e s
u
s
p
e
c
t
.
Process
d
a
ta acq
u
i
sition
carried
o
u
t
b
y
d
i
g
ital fo
ren
s
ic
s
p
r
act
itio
n
e
rs shou
ld con
s
id
er sev
e
ral th
ing
s
,
su
ch
as d
i
g
ital d
a
ta
ev
id
en
ce is
v
e
ry frag
ile b
ecau
s
e
o
f
its
n
a
ture th
at is easily d
a
m
a
g
e
d
(asso
c
iated
with
the
accom
p
anying hardwa
re de
vice), integrity
is highly vu
lnerable to cha
n
ges (qu
ite pos
s
ibly
m
odified),
even
dam
a
ge c
oul
d
have
occu
rre
d
beca
use
of
a t
ech
ni
cal
fa
u
l
t
or
h
u
m
a
n err
o
r
.
Han
d
l
i
n
g i
s
ve
ry
care
f
ul
l
y
do
ne, m
i
st
akes and fai
l
u
res w
oul
d be di
st
o
r
t
i
ng t
h
e e
nd re
su
l
t
even el
im
i
n
at
e i
t
.
It needs c
a
ref
u
l
han
d
l
i
n
g
an
d pro
t
ectio
n
will th
e au
t
h
enticit
y o
f
d
i
g
ital ev
id
en
ce.
An
alysis is th
e stag
e to
d
o
t
h
e ev
alu
a
tion
o
f
t
h
e pro
cess of in
v
e
stig
atin
g
cases th
at o
ccur b
y
u
tilizin
g
the m
e
thods
of ADAM (T
he
Adva
nce
Data
Acquisition M
odel
)
, or Im
plem
entation m
e
thods
of investi
g
ative
services proce
ss ADAM on pri
v
ate
cl
ou
d com
put
i
ng can
pr
o
duce di
gi
t
a
l
dat
a
appr
o
p
ri
at
e evi
d
ence a
nd i
s
a
critical issu
e in
th
e d
a
ta acqu
i
sitio
n
pro
cess so
th
at it can
resp
ond
to
th
e
p
r
ob
lem
o
f
d
a
ta reliab
ility
o
r
p
r
ocess
to
g
e
t t
h
e
d
a
ta
o
f
th
e
d
i
g
ital ev
id
en
ce
o
f
concern th
e atten
t
i
o
n in
cou
r
t
The doc
u
m
e
ntation is the sta
g
es whe
r
e eac
h stage in
t
h
e
pr
ocess
of i
n
v
e
st
i
g
at
i
on f
o
r archi
v
i
n
g o
r
doc
um
ent
a
t
i
o
n
,
any
c
h
an
ges or he obt
ai
ned evi
d
e
n
ce
s
u
p
p
o
rt
i
n
g di
gi
t
a
l
d
a
t
a
reco
rdi
ng/
d
o
cum
e
nt
at
i
on up
dat
e
i
s
d
one
.
3.
R
E
SU
LTS AN
D ANA
LY
SIS
Exp
l
o
itin
g
cli
e
n
t
app
licatio
n
s
Own
Clo
ud th
is can
b
e
d
o
n
e
thr
ough
d
e
sk
top
PC
s as w
e
ll as
Sm
artphones,
while sm
artphone c
o
nnections to private
cloud se
rvices ca
n be done through internet access as
well as access
through t
h
e acc
ess poin
t/hots
p
ots in the l
o
cal
network.
The
res
u
l
t
s
o
f
t
h
e i
n
vest
i
g
at
i
o
n
pr
ocess
t
h
at
i
s
co
n
duct
e
d
by
ap
pl
y
i
ng
A
D
A
M
m
e
t
hod a
r
e as f
o
l
l
o
ws:
a)
In
itial p
l
ann
i
ng:
Mak
i
ng
in
itial p
l
ann
i
ng
rel
a
ted
cases "XYZ
Ho
sp
ital" th
e d
i
v
u
l
g
i
ng
secret i
n
fo
rmatio
n
o
f
t
h
e
com
p
any
w
h
i
c
h i
s
d
o
n
e
by
a st
aff t
o
an
ot
her
pa
rt
y
,
w
h
e
r
e suc
h
i
n
f
o
rm
at
i
on
has b
een
obt
ai
ned
by
expl
oi
t
i
ng t
h
e
weak
nesse
s a
n
d m
i
st
akes t
h
e
go
ve
rna
n
ce
of
pri
v
at
e cl
o
u
d
c
o
m
put
i
ng
ser
v
i
ce.
Evaluation Warning : The document was created with Spire.PDF for Python.
I
J
ECE
I
S
SN
:
208
8-8
7
0
8
Invest
i
g
at
i
o
n
o
n
t
h
e
Se
rvi
ces
of
Pri
v
at
e C
l
o
u
d
C
o
mp
ut
i
n
g
by
Usi
n
g A
D
A
M
Met
h
o
d
(
N
u
r
Wi
di
ya
so
n
o
)
2
391
Det
e
rm
i
n
e t
h
e t
e
am
s t
h
at
wil
l
be i
nvol
ve
d
i
n
t
h
e proces
s of i
nve
st
i
g
at
i
ng suc
h
cases
i
n
cl
udi
n
g
t
h
e
fulfillm
ent of c
o
m
p
eten
ce IT is necessary.
Id
en
tify So
ft
ware ap
p
licatio
ns and
Too
l
s th
at are
n
eed
ed
for th
e inv
e
stig
at
io
n
.
Mak
e
th
e task letter/warran
t
requ
ired
b
y
the o
f
ficer
who
will th
en
b
e
forward
e
d
to
t
h
e
m
a
n
a
g
e
m
e
n
t
"XYZ Ho
sp
ital".
create and
pe
rform
updates a
g
ainst any activi
ties conducted
b)
The
o
n
Si
t
e
Pl
a
nni
ng:
Ide
n
t
i
f
y
so
urc
e
s t
h
at
becom
e
pot
ent
i
a
l
evi
d
ence
s suc
h
a
s
di
gi
t
a
l
dat
a
servi
ce p
r
i
v
at
e
cl
oud se
r
v
er
,
dat
a
l
i
nk l
a
y
e
r
2, l
a
y
e
r
3
net
w
or
k l
a
y
e
r,
5
Se
ssi
on
, a
n
d
l
a
y
e
r
7 a
ppl
i
cat
i
o
n
s
.
Mak
e
p
l
an
s
with
th
e m
e
t
h
od
of d
a
ta
acq
u
i
sition
pro
cess Liv
e
Acq
u
i
sition
s
or Write Blo
c
k
Acqu
isitio
n
s
.
Det
e
rm
i
n
e t
h
e appl
i
cat
i
on S
o
ft
ware bei
n
g use
d
suc
h
as W
i
reS
h
ar
ks
, N
e
t
w
o
r
k M
i
n
n
e
r
,
W
i
nIS
O
o
r
UltraISO
c)
Data acqu
i
sition
:
Obt
a
i
n
di
gi
t
a
l
dat
a
evi
d
ences
fo
u
nd i
n
p
r
i
v
at
e cl
ou
d ser
v
i
ces sy
st
em
, deskt
o
p
pc o
r
sm
art
p
ho
ne,
a
n
d
devi
ces
suc
h
a
s
net
w
o
r
k
swi
t
ches a
n
d r
o
ut
er
s.
Create th
e
results repo
rts
of the in
v
e
stig
atio
n.
In
itial Plan
n
i
ng
team d
e
termin
es th
e d
i
gital fo
ren
s
ic i
n
v
e
stig
ato
r
/an
a
lyst, an
d
consisted
o
f
a
C
h
ai
rm
an and
2-
3 t
eam
m
e
m
b
ers wh
o
ha
ve e
xpe
rt
i
s
e i
n
the field of
IT com
p
etence
in
Gen
e
ral, hav
e
th
e
k
now
ledg
e abo
u
t
t
h
e tech
no
log
y
of
v
i
r
t
ualizatio
n
/
clo
ud co
m
p
u
ting
,
un
d
e
r
s
tand
t
h
e v
a
r
i
ou
s linux-
b
a
sed
ope
rat
i
n
g sy
st
em
such as
wi
n
d
o
w
s
base,
bas
e
, u
nde
rst
a
nd t
h
e st
r
u
ct
u
r
e o
f
fol
d
ers a
n
d fi
l
e
s, u
n
d
erst
a
nd a
b
o
u
t
network sec
u
ri
ty and system
s
suc
h
as
the network de
vice
switch, router
and acce
ss-point, understa
nd
about
technology-bas
ed m
obile serv
ices such as Smartphones
.
In addition a t
eam
of i
nvest
i
g
at
or m
u
st
al
so be abl
e
to
d
e
term
in
e t
h
e typ
e
s and
th
e too
l
s th
at will b
e
u
s
ed
to
p
e
rform
th
e p
r
o
cess of inv
e
st
ig
atio
n
in
th
e
field
as
well as settin
g up
so
ftware
W
i
resh
ark
s
, Network
Mi
n
n
e
r,
UltraISO or
W
i
nISO. Th
en th
e team
sh
o
u
ld
also
p
r
ep
are d
o
c
u
m
en
ts o
r
letters warran
t du
ty
to
p
e
rfo
r
m
th
e
p
r
o
cess
of
inv
e
st
ig
atio
n of
t
h
e
han
d
ling of
cases and
always update
the inform
atio
n
for e
v
ery acti
v
ity whic
h is
done
.
Th
e
on
site p
l
an
n
i
n
g
inv
e
stigatio
n
team
d
e
term
in
es
p
o
t
en
tial so
urces
of
d
i
g
ital d
a
ta ev
i
d
en
ces fou
nd
o
n
p
r
i
v
ate clo
u
d
co
m
p
u
ting
serv
ice an
d
m
a
k
e
s p
l
an
s to
d
e
termin
e th
e p
r
o
cess
o
f
d
a
ta acq
u
i
sition
acquisitio
n
s
liv
e o
r
write-b
lo
ck
acqu
i
sitio
n
s
. Data acqu
isitio
n
pro
cess is sh
own
i
n
Fig
u
re 4
an
d Fig
u
re 5
.
Then
to
det
e
rm
i
n
e t
h
e pr
ocess
,
i
t
can be do
ne
by
us
i
ng t
o
ol
s o
r
so
ft
ware a
ppl
i
cat
i
on t
o
per
f
o
r
m
t
h
e dat
a
acqui
si
t
i
on
pr
ocess
.
Here
i
s
no co
nse
n
s
u
s rega
rdi
ng s
p
eci
fi
c soft
wa
re
appl
i
cat
i
ons
u
s
ed t
o
p
r
ocess
dat
a
acqui
si
t
i
on
on
clo
u
d
co
m
p
u
tin
g serv
ices. Th
is stud
y
u
s
es
sev
e
ral
software app
licatio
n
s
t
o
su
ppo
rt
d
a
ta
acq
u
i
sition
eith
er b
y
liv
e acqu
i
sitio
ns or
write
b
l
o
c
k
acq
u
i
sition
s
.
Fig
u
re 4
is A
flow p
r
o
cess
fo
r acq
u
i
sition
s
wh
ere liv
e d
a
ta so
ftware app
licatio
n
s
or to
o
l
s th
at are
use
d
are
gr
ow
n on
a pri
v
at
e cl
ou
d
se
rvi
c
e
m
achi
n
e.
T
h
e
n
th
e activ
ation
o
f
th
e system
log that is l
o
cat
ed
on a
pri
v
ate cloud s
e
rvice, router
mikro
tik
b
y
m
a
k
i
ng
ru
le (IPS-Firewall-Ch
ain
(Forward
/In
p
u
t/Ou
t
pu
t)
– actio
n
lo
g). Catch
i
n
g
liv
e d
a
ta acq
u
i
sitio
n
s
d
o
n
e
in layer 5
(se
ssi
o
n
layer)
b
y
u
t
ilizin
g
software su
ch
as
wiresh
arks
or
net
w
or
k m
i
nne
r t
o
ol
s. Fi
l
e
s gene
rat
e
d
f
r
om
t
h
e pr
oce
ss of a
rrest
da
t
a
on l
a
y
e
r 5
(
s
essi
on l
a
y
e
r
)
i
s
t
h
is
*.
pcap
(pac
ket
capt
u
res)
or *
.
C
s
cpkt
(c
olasoft capsa pac
k
et) then the file
is an
alyzed
to
fin
d
so
m
e
d
a
ta typ
e
s
suc
h
as
di
gi
t
a
l
pr
o
o
f
fi
l
e
s, m
a
c-ad
dre
ss,
use
r
nam
e
, passw
o
r
d, l
o
g
s
, a
n
d t
i
m
e-st
am
p.
Fi
gu
re
4.
Li
ve
Dat
a
Ac
q
u
i
s
i
t
i
ons
P
r
oces
s
Dat
a
capt
u
re i
s
per
f
o
r
m
e
d usi
ng by
Net
w
or
k M
i
nne
r dat
a
t
r
affi
c hea
d
i
n
g
t
o
war
d
s m
achi
n
e pri
v
at
e
cloud a
nd i
n
the get that client access with i
p
public
(202.95.128.xxx) whi
c
h
pa
sse
s through t
h
e router
device
will u
s
e th
e mac-add
r
ess
o
f
t
h
e rou
t
er
(D4
:
CA:6
D:
68
:8
9
:
0
7
) th
e case
with
d
e
v
i
ces (d
esk
t
op
p
c
/sm
a
rt
p
hon
e)
via the access-poi
nt/hots
p
ots whe
n
access t
o
private cloud
se
rvices a
nd t
h
rough the
de
vice router the
n
i
t
will
b
e
foun
d
to
u
s
e th
e
m
ac-ad
dress of th
e router. Usin
g
too
l
s “n
etwork
mi
n
n
e
r” will b
e
o
b
t
ain
e
d
as a h
o
s
t
,
Evaluation Warning : The document was created with Spire.PDF for Python.
I
S
SN
:
2
088
-87
08
I
J
ECE
Vo
l. 6
,
N
o
. 5
,
O
c
tob
e
r
20
16
:
238
7
–
23
95
2
392
fram
e
s, fi
l
e
s, i
m
age, m
e
ssage, cre
d
ent
i
a
l
s
, s
e
ssi
ons
, D
N
S
(
s
),
param
e
t
e
rs, key
w
or
d, cl
ea
rt
ext
an
d a
nom
al
i
e
s,
resu
lts d
a
ta
cap
t
ure will
b
e
sav
e
d
in
th
e file b
e
reksten
s
ikan
.
Th
is p
c
ap
(p
ack
e
t cap
t
ures).
Utilizin
g
featu
r
es
th
at are
own
e
d
b
y
n
e
t
w
ork
m
i
n
n
e
r can
g
i
v
e
th
e
requ
ired
resu
lts in
t
h
e
d
a
ta
liv
e acqu
i
sitio
n pro
cess.
Figure 5. is a process
of ac
quisition
data is wr
ite-bloc
k
,
whe
r
e all access th
at leads to the
privat
e
clo
u
d
serv
ices do
b
l
o
c
k
i
ng access so
that th
e
d
a
ta th
at
will b
e
acqu
i
red are
no
t ch
anged
o
r
o
m
itted
b
y
the
sus
p
ect. T
h
e
proces
s of
bloc
king access
ca
n
be done thro
ugh t
h
e m
i
krotik route
r
os by
m
a
king the
rules on
th
e Firewall-IP-IP Desti
n
atio
ns drop
action
.
Fig
u
re 5
.
Th
e Process Write Blo
c
k
Data Acq
u
i
sition
s
Priv
ate cl
o
u
d
serv
ice system
s
g
r
own app
licatio
n
s
th
at
h
a
v
e
th
e ab
ility to
p
r
o
cess im
ag
ing
file (*.iso
or
*.
dd
) o
r
p
r
o
cess dat
a
acq
ui
si
t
i
on can
be p
e
rf
orm
e
d rem
o
t
e
l
y
t
o
t
h
e
m
a
chi
n
e e
v
en t
h
o
u
gh t
h
e pri
v
at
e cl
ou
d
servi
ces t
h
ro
u
gh a l
o
cal
ar
ea net
w
o
r
k (
L
AN
). C
a
se s
i
m
u
l
a
t
i
on perf
orm
e
d usi
n
g Ul
t
r
aIS
O
o
r
W
i
n
I
S
O
ap
p
lication
,
after th
e kno
wn po
sitio
n
o
f
t
h
e fo
ld
ers an
d
files th
at
reside on
t
h
e
p
r
i
v
ate clo
u
d
co
m
p
u
tin
g
servi
ce m
achi
n
e t
h
en co
nd
uct
e
d t
h
e pr
ocess
of i
m
agi
ng fi
l
e
s and d
o
an ex
am
i
n
at
i
on of t
h
e has
h
val
u
e
on t
h
e
files. Th
e im
ag
e file n
e
x
t
an
alysis a
nd
discover
files that beca
m
e
the obje
ct
of ab
use
or
som
e
fi
l
e
s t
h
at wer
e
leak
ed
to
t
h
ird p
a
rties on
a sim
u
la
ted
case an
d
t
h
e n
e
x
t
step
is to
m
a
k
e
th
e acq
u
i
sition
pro
cess rep
o
rt data in
write-bloc
k
.
Acquisition data
process
with
ADAM m
e
thod can be
done per de
vice
that
has
the potent
ial
of
di
gi
t
a
l
dat
a
so
urces
e
v
i
d
e
n
ce
s suc
h
as se
rv
ers,
des
k
t
o
p
P
C
s, sm
art
p
h
o
n
e
s,
net
w
or
k
de
vi
ces s
u
c
h
as
ro
ut
er
mik
r
o
tik
so on sim
u
lat
i
o
n
case stud
y in d
i
g
ital d
a
ta tab
l
e can b
e
co
m
p
i
l
ed
ev
id
en
ce
fo
und
as presen
ted i
n
tab
l
e 1
as fo
llows:
Tab
l
e 1
.
Data Acqu
isitio
n
Dev
i
ce
acco
r
d
i
ng
to
Metho
d
ADAM
No.
Parameter
Private
Cloud
De
sktop P
C
Smar
tphone
Route
r
1 IP
Source
√
√
√
√
2
Mac Address Source
√
√
√
√
3 IP
Destinations
√
-
-
√
4
Mac Address De
stination
√
-
-
√
5
F
iles
F
o
lder
S
t
ru
ctures
√
√
√
-
6
Log Activity
- S
y
stem
√
√
-
√
7
Username dan P
a
ssword
√
√
√
-
8 Time
Stamp
√
√
√
√
9 Data
Locations
√
√
√
-
10
Protocol &
Port Access
√
√
√
√
11
Browser – ar
tef
a
ct
√
√
√
-
W
i
t
h
Tab
l
e
1
t
o
g
e
t th
e m
ac-ad
dress of th
e
o
r
i
g
in
al
so
urce d
i
fficu
lties are cau
sed
wh
en a d
e
sk
top
PC
(Pers
o
nal
C
o
m
put
e
r)
or
sm
art
p
h
one
de
vi
ce
con
n
ect
ed
t
o
a
net
w
or
k
de
vi
ce suc
h
as a
r
out
e
r
t
h
e
n
t
h
e
m
ac-
address
m
ac-a
d
dress is
us
ed
on the
router.
B
l
ocki
n
g
A
cce
ss was i
n
t
e
nde
d t
o
c
o
n
d
i
t
i
on
t
h
e Fi
l
e
s cont
a
i
ned
on t
h
e p
r
i
v
at
e cl
ou
d se
rv
i
ces di
d n
o
t
change. Im
age files created a
r
e stor
ed
with
th
e file n
a
m
e
“Dig
italEv
i
d
e
nceRSIAXYZ.iso
”
, t
h
is im
ag
e
files
th
en ch
eck
e
d
t
h
e M
D
5 hash
v
a
lu
es:
08
C170
7E0D1
0
0
B
6E9
255
FC
3
503
0C5
7
F
0
,
to en
su
re th
e orig
inality o
f
th
ese files
with MD5 Ch
eck
s
um
to
o
l
&
SHA
as shown in
Fig
u
re
6
.
Evaluation Warning : The document was created with Spire.PDF for Python.
I
J
ECE
I
S
SN
:
208
8-8
7
0
8
Invest
i
g
at
i
o
n
o
n
t
h
e
Se
rvi
ces
of
Pri
v
at
e C
l
o
u
d
C
o
mp
ut
i
n
g
by
Usi
n
g A
D
A
M
Met
h
o
d
(
N
u
r
Wi
di
ya
so
n
o
)
2
393
Fi
gu
re
6.
M
D
5
& S
H
A C
h
eck
sum
Based
o
n
th
e resu
lts th
at
h
a
ve b
e
en
ob
tain
ed
fro
m
th
e su
sp
ect, t
h
e
n
e
x
t
step
is to verify
th
e i
n
fo
rm
atio
n
fro
m
stru
cture an
aly
s
is o
f
th
e activ
ity lo
g
file fo
ld
ers, system
,
ti
m
e
sta
m
p
,
o
r
a sou
r
ce
o
f
d
i
g
ital ev
id
en
ce th
at
evi
d
e
n
ce
obt
ai
ned
f
r
om
pri
v
a
t
e cl
ou
d se
rve
r
s, de
skt
op
PC
s
,
an
d Sm
art
p
h
o
n
es T
h
i
s
*.
pca
p
. T
h
e
res
u
l
t
s
of t
h
e
veri
fi
cat
i
o
n
o
n
a sm
art
pho
ne c
a
n
be s
h
ow
n i
n
Fi
g
u
re
7
.
Fi
gu
re 7.
fi
l
e
s on
t
h
e Sm
art
p
h
one
Ve
ri
fi
cat
i
o
n (a)
Figure 8.
Struc
t
ure File
Fol
d
e
r
Se
rve
r
Side Verificatio
n (b
)
Based
on
th
e
resu
lts ob
tain
ed o
n
the priv
ate clo
u
d
d
a
ta f
ile fo
ld
er stru
cture o
f
th
e
un
no
ticed
d
i
g
ital ev
id
en
ce
as in Figure
8. a
b
ove
. T
h
e im
age above s
h
ows t
h
e
d
a
ta of
d
i
g
i
tal ev
id
en
ce
foun
d
is l
o
cated
at
c:\\x
a
m
p
p
\
h
t
docs\o
w
n
c
loud
\data\p
u
r
wan
ti\files, and
t
h
e
n
a
me
o
f
t
h
e
files th
at are fou
nd are “aku
n
t
an
si
-d
an
-
tarif.zip,
”
do
k
u
m
e
n-strategis
-rsia-
x
y
z
.zip
a
n
d
re
nca
n
a-
sdm
-rsia-x
yz-201
4-k
o
n
s
u
ltan
.
zip
,
all three
of th
ese
files are i
n
the
sus
p
ect bec
o
me
s
the object of
the problem
.
Th
e ab
ility o
f
Netwo
r
k
Minner in th
e cap
t
ure d
a
ta in
layer
5
(session
layer) as sh
own
in
Fig
u
re
9
.
Figu
re
9.
Cre
d
entials Veri
fication
(c)
Evaluation Warning : The document was created with Spire.PDF for Python.
I
S
SN
:
2
088
-87
08
I
J
ECE
Vo
l. 6
,
N
o
. 5
,
O
c
tob
e
r
20
16
:
238
7
–
23
95
2
394
Ow
nC
l
o
u
d
cl
i
e
nt
ap
pl
i
cat
i
o
n
can al
so
be m
a
de ve
rification
of th
e su
sp
ect with
lo
g-like Fig
u
re 10
.
See th
e
resu
lts o
f
th
e i
n
v
e
sti
g
atio
n b
y
u
s
ing
ADAM,
ob
tain
in
g th
e
results wh
ich led
t
o
th
e
abu
s
e
o
f
p
r
i
v
ate
cl
ou
d se
r
v
i
ces i
n
X
Y
Z
h
o
sp
i
t
a
l
i
s
a use
r
m
a
nagem
e
nt
weak
nesse
s
on
t
h
e a
p
pl
i
cat
i
on se
r
v
er
ve
rsi
o
n
5.
0
.
5
ow
nC
l
o
u
d
so
am
ong
use
r
s i
n
t
h
e sam
e
gr
ou
p ca
n cha
n
g
e
t
h
e pass
w
o
r
d
.
Veri
fi
cat
i
o
n
of
di
gi
t
a
l
evi
d
ence
fi
n
d
i
n
gs o
f
dat
a
on sm
art
p
h
o
n
es,
des
k
t
o
p a
nd
pri
v
at
e cl
o
ud c
o
m
put
i
ng
serve
r
si
de
, as
wel
l
as pr
oce
ss dat
a
acq
u
i
sition
d
i
rectly o
r
write-b
lo
ck
acqu
i
sitio
n
can
b
e
d
one
with
th
e p
e
rcen
tag
e
o
f
su
ccess in
th
e process o
f
investigation
m
e
thod
ADAM service
pr
ivate cloud c
o
m
puting is
100%
.
T
h
e s
u
ccess i
nve
stigation in the cas
e
XYZ
ho
sp
ital is ab
le to
lo
cate file fo
ld
er lo
catio
n
dat
a
d
i
gi
t
a
l
evi
d
ence
, use
r
nam
e
s and
pass
w
o
r
d
s,
t
i
m
e
sta
m
p
s
, ip
add
r
ess and
m
a
c
-
add
r
ess, and
th
e su
itab
ility
o
f
th
e d
a
ta file d
i
g
ital ev
i
d
en
ce
o
b
t
ai
n
e
d
fro
m
sm
art
phone
s,
d
e
skt
o
p c
o
m
put
ers a
n
d
o
n
c
o
m
put
e
r
s c
o
m
put
i
n
g
p
r
i
v
at
e cl
ou
d.
Fig
u
r
e
10
. Own
Clou
d
Clien
t
Log
V
e
r
i
f
i
catio
n
(d
)
To Im
prove
d
the security in m
i
nimizing the o
ccurre
nce of a
buse c
a
n take adva
ntage of t
h
e
t
echn
o
l
o
gy
of
vi
rt
ual
p
r
i
v
at
e
net
w
or
k ser
v
i
c
es, usi
n
g a p
r
o
duct
t
h
at
ha
s a bet
t
e
r use
r
m
a
nagem
e
nt
, an
d pol
i
c
y
m
a
nagem
e
nt
ent
e
r
p
ri
se i
n
us
i
ng
pri
v
at
e cl
o
ud c
o
m
put
i
n
g
servi
ces t
o
be
t
i
ght
ene
d
a
nd
rest
ri
ct
ed t
o
sp
eci
fi
c
users
.
4.
CO
NCL
USI
O
N
The u
s
e o
f
t
h
e A
D
A
M
m
e
t
h
o
d
(T
he
A
dva
nce
d
Dat
a
Acq
u
i
s
i
t
i
on
M
odel
)
i
n
t
h
e
pr
ocess
of
investigating
pri
v
ate cloud com
puti
ng services has bee
n
success
f
ully ca
rried out.
The proce
ss of data
acquisition on the service can be succes
ed e
ither directly or writing bloc
k acquisition pe
r device so tha
t
the
p
r
ob
lem
s
o
f
reliab
ility o
f
ev
i
d
en
ce as
d
i
g
ital d
a
ta can
b
e
ju
stified
i
n
co
urt. Referri
n
g
t
o
th
e case
of poten
tial
ab
use XYZ hosp
ital ag
ain
s
t
disse
m
i
n
a
ti
o
n
of confid
en
tial d
a
ta m
a
y o
ccu
r du
e t
o
t
h
e we
akne
ss
of t
h
e c
u
rrent
syste
m
, or c
o
nfiguration errors, this ca
n
occ
u
r
becau
se
polic
y abuse for
pri
v
ate
cloud c
o
mputing
services
.
Next
researc
h
can b
e
d
o
n
e f
o
r pe
rf
orm
i
ng a
n
an
al
y
s
i
s
of t
h
e s
o
ft
wa
re
or
har
d
ware
use
d
t
o
per
f
o
rm
d
a
ta acqu
i
sitio
n
pro
cess
o
n
clo
u
d
co
m
p
u
ting
serv
ices,
b
e
cau
s
e
u
n
til no
w th
ere is still no
con
s
en
su
s
on
the
stan
d
a
r
d
ization of
its use.
REFERE
NC
ES
[1]
Webb E.H., "Digital Investigatio
ns in th
e C
l
oud."
Farnbor
ough, UK:QinetiQ Dig
i
tal Inv
e
stigations
Service, 2010.
[2]
Carlin
,Sean
, and
Kevin Curran
.
”Cloud Computing techno
l
ogies
.”Intern
ation
a
l J
ournal of Cloud
Computing and
Services Scien
c
e 1.2
(2012):59.
[3]
Lovell H., Max
w
ell W., Wolf C
., DCA Global
Reality
: G
overn
mental Access to Data
in
the Cloud A comparative
analy
s
is of
ten in
ternati
onal ju
risdictions
, Hogan
Love
ll White pap
e
rs.13, 2012.
[4]
National Institu
t
e
of Stand
a
rd and Techno
log
y
(NIST)
,Chal
l
en
ging securi
t
y
r
e
quirem
e
nts for
US governm
e
nt
Cloud Com
puting adoption
,
U.S. Departm
e
nt
of Com
m
e
r
ce,
National Institu
t
e
of Stand
a
rds and Technolog
y,
Gaitherbug
, 201
1.
[5]
Lessing M., Solms B.V., "Live
Forensic Acquis
ition
as Alte
rn
ative to Tr
aditional Forensic Proces
ses", Council for
Scientif
ic and
In
dustrial Research Meiring
Naud
é Road
, Scientia
Pretor
ia, South
Africa, 2011.
[6]
Shahzad A., Musa S., Aborujilah
A., and M. Irfan, A Ne
w Cloud
Based Supervisor
y
Control And
Data Acquisitio
n
Implementation
To Enhance The Level Of Security
Using
Testbed, Journal of Computer Science
10 (4): 652-659,
ISSN: 1549-3636, 2014
.
Evaluation Warning : The document was created with Spire.PDF for Python.
I
J
ECE
I
S
SN
:
208
8-8
7
0
8
Invest
i
g
at
i
o
n
o
n
t
h
e
Se
rvi
ces
of
Pri
v
at
e C
l
o
u
d
C
o
mp
ut
i
n
g
by
Usi
n
g A
D
A
M
Met
h
o
d
(
N
u
r
Wi
di
ya
so
n
o
)
2
395
[7]
Cheng, Fa-Chang, and Wen-
Hsing La
i.”Creating
the env
i
r
onment for th
e prosperity
of
cloud computing
techno
log
y
”.I
n
d
onesian Journal
of Electr
i
cal
Eng
i
neer
ing and
Co
mputer Sciense
10.4 (2012):864
-
875.
[8]
Bodenheimer, D
.
Z., Cloud
Computing Acqu
isitions &
C
y
ber
security
. Briefing P
a
pers, No. 12-11
, 20
, 2012
.
[9]
Marty
R
,
“Clou
d
application lo
gging for forens
ics,”
in proceed
ings of the 201
1 ACM Sy
mposium on Applied
Computing. AC
M, 2011, pp. 17
8–184, 2011
.
[10]
Adams R,
V.
H.
,
The Advanced
Data
Acquisition Model (ADAM
):
A Process Mo
del For Digital Forensic Practice.
Journal of D
i
gital Forensics, Secu
ri
ty
and
Law, Vol. 8(4)
, 24
, 201
3.
[11]
Ruan K, P. J., C
l
oud forensics: A
n
overview.
I
B
M
Ireland Ltd
, 16
.
2011.
[12]
Huber M, Mulaz
zani M,
Lei
t
hner
M, Sc
hrittwi
e
se
r S, W
ondracek
G,W
e
ippl,
E, So
cia
l
snapshots: digita
l forensi
c
s
for online social networks, In:
A
nnual Computer Security
App
licati
ons Confer
ence – ACSAC 2011, Orlando,
Florida, USA; 2011, pp
. 113–12
2, 2011
.
[13]
Barrett D & Kipper G,
Virtualiz
ation and Forens
ics: a dig
ital for
e
nsic inve
stigato
r
'
s
guide to v
i
rtu
a
l environmen
ts,
S
y
ngress, 2010
.
[14]
Birk D & Weg
e
ner C, Technical Issues of fo
rensics II
nvestig
ations in
cloud
com
puting env
i
ronments, Sixth
International Wo
rkshop on S
y
stematic
Approach
es to Dig
ital For
e
nsic
Engineerin
g (SADFE), IEEE, 2011
.
[15]
Shams Z, R Has
a
n, C
l
oud Foren
s
ics: A
Meta-Stu
d
y
of Challenges
,
Approaches
, an
d Open Problems, University
of
Alabama
at B
i
r
m
ingham, Alabama 35294-1170,
2013.
[16]
Dar
y
abar F, Dehghantanh
a
A, et All, A Survey
A
bout Impacts of Cloud Computing on Digital Forensics
International Jo
urnal of C
y
b
e
r-
Security
and D
i
gital
Forensics
(IJCSDF) 2(2)
: 77-94,
The S
o
ciety
of Digital
Information and
Wireless Comm
unications, (ISSN:
2305-0012), 2013.
[17]
Shirkhedkar D,
Patil S, Design
of digit
a
l for
e
nsi
c
techniqu
e for
cloud com
puting, Intern
ation
a
l Jo
urnal of Advan
c
e
Research
in
Co
mputer Scien
c
e
and Manag
e
men
t
Studies
, Volume 2, Issue 6
,
ISSN: 2321-7782, 2
014.
[18]
Zim
m
e
rm
an S
,
and Glava
c
h D,
“
C
y
b
er F
o
r
e
n
s
ics
in th
e Clo
ud,”
I
A
Newsletter
, vol. 14, n
o
. 1, pp. 4-7
;
http:/
/iac.d
tic.
m
i
l/iatac/download
/
Vol14_No1.pdf
, 2011
.
[19]
Zaty
ko
K & Bay J , The Digital f
o
rensics cy
b
e
r
exchange prin
ciple,
Forensics Magazin
e
, pp.5-13
,
2011.
[20]
Anwar,N, Riadi,I, Luthfie,A
,
Forens
ic SIM Card Cloning Using Authenticati
on Algorithm, IJEIE, Vol. 4, No. 2
,
pp. 71-81
,2016.
[21]
Tay
l
or M, Hagg
erty
J, Gresty
D, La
mb D, Forensic investig
ation
of cloud
computing s
y
stems. Network Security
,
(3):4–10, 2011
.
[22]
McKemmish R, What is for
e
nsic
computing
?
Trends
& Issues in
Crime and
Criminal Justice;118
:1
–6, 1999
.
[23]
Kent K, Chevalier S, Grance, T., & Da
ng, H., Gu
ide to Integratin
g Forensic
Tech
niques into Incid
e
nt Response. In
National Institute of Standards
a
nd Technolog
y
(
E
d.) (Vol. 8
00-8
6
):
U.S. Depar
tment
of Commerce,2006
.
[24]
Reilly
D, Wren
C & Berr
y
T, Cloud Computing: Forens
ics Challeng
es for Low enforcement, International
Conference for
I
n
ternet Techno
lo
g
y
and Se
cured
Transactions (IC
ITST), I
E
EE, 20
10.
Evaluation Warning : The document was created with Spire.PDF for Python.