Center for Information Security and Assurance
University of Maryland, Baltimore County
Cloud Forensics and its Many Challenges
Ken Zatyko
Assured Information Security, Inc.
12-1pm, Friday 1 November 2013, ITE 229, UMBC
In this presentation, we present a challenge question for today’s cyber experts, cyber scientists, and cyber analysts. Does Locard’s Exchange Principle apply in digital forensics? The dramatic increase in cybercrime and the repeated cyber intrusions into critical infrastructure demonstrate the need for improved security. The Executive Office of the President noted on May 12, 2011 “cyber threat is one of the most serious economic and national security challenges we face as a nation.” We believe addressing whether or not Locard’s Exchange Principle applies to digital forensics is a fundamental question that can guide or limit the scientific search for digital evidence.
Locard’s Exchange Principle is often stated in forensics publications “every contact leaves a trace…” Essentially Locard’s Exchange Principle is applied to crime scenes in which the perpetrator(s) of a crime comes into contact with the scene. The perpetrator(s) will both bring something into the scene, and leave with something from the scene. In the cyber world, the perpetrator may or may not come in physical contact with the crime scene, thus, this brings a new facet to crime scene analysis. According to the World of Forensic Science, Locard’s publications make no mention of an “exchange principle,” although he did make the observation “Il est impossible au malfaiteur d’agir avec l’intensité que suppose l’action criminelle sans laisser des traces de son passage.” (It is impossible for a criminal to act, especially considering the intensity of a crime, without leaving traces of this presence.)
The term “principle of exchange” first appears in Police and Crime-Detection, in 1940, and was adapted from Locard’s observations. The field of digital forensics can be strictly defined as “the application of computer science and investigative procedures for a legal purpose involving the analysis of digital evidence after proper search authority, chain of custody, validation with mathematics, use of validated tools, repeatability, reporting, and possible expert presentation. (Zatyko, 2007).” Furthermore, digital evidence is defined as information stored or transmitted in binary form that may be relied on in court. (National Institute of Justice, 2004). However, digital forensics tools and techniques have also been used by cyber analysts and researchers to conduct media analysis, compile damage assessments, build timelines, and determine attribution. According to the Department of Defense Cyber Crime Center’s training program, cyber analysts require knowledge on how network intrusions occur, how various logs are created, what is electronic evidence, how electronic artifacts are forensically gathered, and the ability to analyze data to produce comprehensive reports and link analysis charts.
Our hypothesis is that Locard’s Exchange Principle does apply to cyber crimes involving computer networks such as identity theft, electronic bank fraud, or denial of service attacks, even if the perpetrator does not need to physically come in contact with the crime scene. Although the perpetrator may make virtual contact with the crime scene through the use of a proxy machine, we believe he will still “leave a trace” and digital evidence will exist. This presentation will explore with audience input “where in the cloud is digital evidence found” and new ways it can lead to attribution. It will explore what new standards and techniques are needed to find these digital traces. Read ahead information can be found at here.
Ken Zatyko was previously the Director of the Department of Defense Computer Forensics Laboratory where he led the largest accredited, internationally recognized, leading-edge computer forensics laboratory located in Maryland. For several months, Mr. Zatyko has been working with NIST on a working group to further standards and technology to solve cloud forensics challenges. Mr. Zatyko is currently the Vice President of Maryland Operations with Assured Information Security.