1) Performing digital forensic analysis of cloud computing resources can be challenging. There must be some unique approaches to dealing with digital forensic examination of data stored with cloud service providers. It’s unique enough, in fact, that it has been considered its own subset of digital forensics, aptly labeled “Cloud Forensics.”

The first challenge to cloud forensics is jurisdiction/location. The data stored with the cloud service provider may be in different physical locations with different sets of laws that govern each location. This may be different states, or even different countries. This complicates the process of attempting to gain legal access to the data to conduct cloud forensics.

The next challenge is ensuring the data is accurate in that it has not been tampered with by the cloud service provider in any way (intentionally or unintentionally) and that it does not contain data from other users of the cloud service. Collection of the data for cloud forensic analysis is usually dependent on the company providing the cloud services, which potentially allows for third-party interference with the evidence. Additionally, some cloud services have multi-tenancy, which means that multiple user’s data is stored on the same set of resources. This could create a situation where a different user’s data accidentally gets mixed up into the targeted data set. Both of these issues (dependency and multi-tenancy) could call the integrity of the data into question in a court of law.

2) Digital forensics in the cloud can get complicated. There are a lot of issues ranging from cloud type, services rendered, and legal jurisdiction. With traditional IT services, the owner of the hardware was responsible for the data on it and the upkeep of the systems. In the cloud, this responsibility can get shifted depending on what kind of cloud it is. There are public clouds, private clouds, and hybrid clouds. Then there are different cloud services. IaaS, PaaS, and SaaS. The ownership of data is shared in these models. Some allow the developers to have full control of the data including logs, some don’t.

A cloud may also be physically located thousands of miles away from the user. If a user is using a cloud infrastructure to based in China to commit illegal acts in the US, does the local, state, or even national level law enforcement agencies have a legal jurisdiction to get the data? While doing an analysis, if the examiner finds evidence that the data was hosted outside of the country, this can bring with it a whole mess of legal questions that aren’t clearly answered yet.