Time synchronization: pivotal element in cloud forensics
Nikolaos Marangos, Panagiotis Rizomiliotis, Lilian Mitrou · Security and Communication Networks · 2014
Abstract Cloud computing (CC) is the new trend in computing and resource management. This architectural shift toward thin clients and the centralized on‐demand provision of computing resources aspires to offer significant economical benefits to its users. However, the adaption of the CC model has forced many times the IT industry and the academia to revisit most of the traditional tools and technologies. The last few years, it has been identified that one of the computer branches that has been most affected by the CC model is Digital Forensics, one of the main law enforcement tools in the cyberspace. In this context, a new security area was born, the so‐called cloud forensics (CF). In this paper, we investigate the impact that the CC model has on the trustworthiness of one of the main CF sources of information, the log‐files. More precisely, we bring forth a crucial but rather underestimated problem, the problem of accurate log‐records timestamping. The synchronization of time (stamps) is of major importance for the investigation logs to be used as source of evidence. We show that this requirement is not easy in the cloud context. We demonstrate that the main features of CC render existing time synchronization techniques inadequate, and we provide a list of guidelines toward a CF aware timekeeping system. Copyright © 2014 John Wiley & Sons, Ltd.