A Functional Classification of Forensic Access to Storage and its Legal Implications

Hammer A, Ohlig M, Geus J, Freiling F (2023)

Publication Language: English

Publication Type: Conference contribution, Conference Contribution

Publication year: 2023

Publisher: ACM

Conference Proceedings Title: Proceedings of the 12th International Conference on IT Security Incident Management & IT Forensics

Event location: Munich

DOI: 10.1145/3609231

Abstract

Due to their ease of use and their reliability, managed storage services in the cloud have become a standard way to store files for many users. Consequently, data from cloud storage services and remote file systems in general is an increasingly valuable source of digital evidence in forensic investigations. In this respect, two questions appear relevant: (1) What effect does data acquisition by the client have on the data stored on the server? (2) Does the technology support delayed verification of data acquisition? The two questions refer to critical aspects of forensic evidence collection, namely in what way does evidence collection interfere with the evidence, and how easy is it to prove the provenance of data in a forensic investigation. We formalize the above questions and use this formalization to classify common storage services. We argue that this classification has direct consequences with regard to the probative value of data acquired from them. We therefore discuss the legal implications of this classification with regard to probative value so that IT expert witnesses can adapt their procedures during evidence acquisition and legal practitioners know how to assess such procedures and the evidence obtained through them from cloud storage services.

Authors with CRIS profile

Related research project(s)

How to cite

APA:

Hammer, A., Ohlig, M., Geus, J., & Freiling, F. (2023). A Functional Classification of Forensic Access to Storage and its Legal Implications. In Proceedings of the 12th International Conference on IT Security Incident Management & IT Forensics. Munich, DE: ACM.

MLA:

Hammer, Andreas, et al. "A Functional Classification of Forensic Access to Storage and its Legal Implications." Proceedings of the 12th International Conference on IT Security Incident Management & IT Forensics, Munich ACM, 2023.

BibTeX: Download