Adding event reconstruction to a cloud forensic readiness
Adding Event Reconstruction to a
Cloud Forensic Readiness Model
Presenter: V.R Kebande
Supervisor: Prof Hein.S. Venter
University of Pretoria
What is the focus of Digital Investigations Currently?
Searching for Digital Evidence
Collection of Digital Evidence
Examining the Properties of Collected Evidence.
But why is that Evidence Really Evidence?
Important Aspect: Need to Identify what CAUSED
Evidence to have the properties it has.
ER examines and analyses the evidence to identify why it has
its characteristics [Carrier & Spafford, 2004].
ER will pose the following questions:
Why Evidence has the properties
Where could they have come from?
When were they created?
This may help to create a hypothesis for a DFI
Reconstruction identifies events for which evidence exist to
support their occurrence.
What is Event Reconstruction
Forensic Readiness-Maximizing an environment’s
ability to collect credible Digital Evidence.
Minimizing the cost of forensic investigation during
incident response [Rowlingson, 2004]
ISO/IEC 27043-”occurs before incident detection”
A Cloud Forensic Readiness Model
Retaining Critical Information
Collecting appropriate Digital Evidence
So, How can a Cloud be Forensically
Event search function
Similarity measure between events represented by
Minkowskis’ distance function
p=1,2…to ∞ is [comparative metric for suitable distance
metric between events]
dMD-Is the distance metric for Minkowski Distance
),( BAd MD
i ii BA ||1
Event reconstruction based on the distance function
help achieve the following:
To be able to distinguish one event from the other
Predict behaviour of events
Distinguish one event from the other through focusing on
the relationship between them
Enables a discovery of the structure of events
Using distance metric