Isolating instances in the cloud

Delport and Olivier

2012

Citation information

Abstract

Cloud Computing is gaining acceptance and increasing in popularity. Organizations often rely on Cloud resources to effectively replace their ‘in-house’ computer systems. In a Cloud environment, an instance is typically accepted to be a virtual system resource, established within that Cloud. Multiple instances can also form one logical instance. Multiple instances can be contained within a single node. The Cloud itself consists of multiple nodes.

In order to facilitate a Digital Forensic Investigation (DFI) a Digital Forensic Process (DFP) is followed. The DFP defines a finite number of steps to aid in the successful completion of the DFI. Isolating the environment is generally accepted within the Forensic Community to be an integral part of a Forensic process. We contend that this isolation is also needed in a DFI. The isolation prevents any further contamination of or tampering with possible evidence.

This paper serves as a starting point for a possible Digital Forensic Process (DFP) to facilitate an investigation in a Distributed Instance System (DiS) environment. It focuses on the process to isolate an instance. Conditions are introduced to act as a guide for the successful isolation of an instance. It also considers the complications that can occur when doing a digital DFI in a DiS.

Full text

Full text

Definitive version

BibTeX reference