Applying Digital Forensic Evidence Acquisition Methods to Cloud Computing Environments: An Expert Panel Delphi Studi

As business models change to incorporate a wide variety of cloud computing environments, the escalation of computer crimes from hacking and security breaches related to cloud computing environments has steadily increased. Methods to investigate crime in a cloud computing environment are limited due to the complexity of the cloud environment. In a cloud computing environment, traditional digital forensic processes (such as turning off the computer to image the computer hard drive) can be disruptive to legitimate businesses because the data of legitimate businesses may be co-mingled with illegal content. The purpose of this qualitative Delphi study was to develop a robust contingency framework for deciding when to use traditional forensic investigative practices, when to use modified processes, and when it is necessary to develop new forensic investigative processes more appropriate to the cloud computing environment. The contingency framework was developed through the evaluation of 20 common forensic procedures by a panel of 14 forensic and cloud computing subject matter experts. The Delphi methodology used a purposive sample and based expert selection on specific qualification criteria. Data for the study were gathered through online written narrative interview questionnaires using SurveyMonkey, an online data collection tool. Dedoose qualitative software was used as the input method to map qualitative data from the online written narrative interview questionnaires using thematic and pattern coding analyses to identify data themes and patterns. Findings indicated that about 50% of the current digital acquisition processes applied to cloud computing environments; the rest required modification or new process development. Consensus was not reached on 30% of the processes indicating that even a panel of experts experienced difficulty agreeing on some processes when discussing the application of digital forensic evidence acquisition methods to cloud computing environments. Recommendations for policymakers, practitioners, and educators included proper guidance pointed in solid direction, implementation of the proposed contingency framework, professional organizations taking the lead in setting forensic policy for directing practice, and improved training and education. Recommendations for future research included expanded contingency theory application, targeting specific types of cloud computing, using a larger sample population, and expanding the number of acquisition processes examined.