Presentation at the ICSA Lab

1. Adding Event Reconstruction to a
Cloud Forensic Readiness Model
Presenter: V.R Kebande
Supervisor: Prof Hein.S. Venter
University of Pretoria

2. What is the focus of Digital Investigations Currently?
 Searching for Digital Evidence
 Collection of Digital Evidence
 Examining the Properties of Collected Evidence.
But why is that Evidence Really Evidence?
Important Aspect: Need to Identify what CAUSED
Evidence to have the properties it has.
Introduction

3. ER examines and analyses the evidence to identify why it has
its characteristics [Carrier & Spafford, 2004].
ER will pose the following questions:
 Why Evidence has the properties
 Where could they have come from?
 When were they created?
This may help to create a hypothesis for a DFI
Reconstruction identifies events for which evidence exist to
support their occurrence.
What is Event Reconstruction

4.  Forensic Readiness-Maximizing an environment’s
ability to collect credible Digital Evidence.
 Minimizing the cost of forensic investigation during
incident response [Rowlingson, 2004]
 ISO/IEC 27043-”occurs before incident detection”
A Cloud Forensic Readiness Model

5.  Proactive Approach
 Retaining Critical Information
 Collecting appropriate Digital Evidence
So, How can a Cloud be Forensically
Ready?

6. High-level view of the Model

7.  What is involved?
Event reconstruction
Event reconstruction Process
 High-level Process
 Detailed process
Proposed
Enhanced Cloud Forensic readiness
Model

8. Enhanced Cloud Forensic Readiness
Model

9. Reconstruction
Reconstruction Process

10. P
S
A1
A2 A3
An
Wi Xi
yi Znei
(Clu_N)
(Clu_N) (Clu_N)
(Clu_N)
Event search function

11. Similarity measure between events represented by
Minkowskis’ distance function
A,B-Events
p=1,2…to ∞ is [comparative metric for suitable distance
metric between events]
dMD-Is the distance metric for Minkowski Distance
Similarity Measure
),( BAd MD
pp n
i ii BA ||1 


12. Event reconstruction based on the distance function
help achieve the following:
 To be able to distinguish one event from the other
 Predict behaviour of events
 Distinguish one event from the other through focusing on
the relationship between them
 Enables a discovery of the structure of events
Using distance metric

13.  The ECFR can still be extended.
Conclusion