Proactive digital forensics in the cloud using virtual machines

With the advent of cloud computing systems it has become possible to provision large scale systems in a short time with little effort. The systems underpinning these cloud systems have to deal with massive amounts of data in order to function. Should an indecent occur that requires some form of forensic investigation it can be very challenging for an investigator to conduct the investigation. This is due, in large part, to the volatility of data in cloud systems. In this paper, a model architecture is proposed to enable proactive forensics of cloud computing systems. Using a reference architecture for cloud systems, an add-on system is created to enable the capture and storage of forensic data. The captured data is then available to the investigator should the need for an investigation arise. This must be achieved with minimal alteration or interruption of existing cloud systems. The system is described and a theoretical architectural model is given. An evaluation discusses the possible advantages and disadvantages of such a system and how it can be implemented as a proof of concept. It also relates the proposed model to the ISO 27043 standard of forensic investigations.