Digital Forensics Tool Testing - Image Metadata in the Cloud

As cloud based services are becoming a common way for users to store and share images on the internet, this adds a new layer to the traditional digital forensics examination, which could cause additional potential errors in the investigation. Courtroom forensics evidence has historically been criticised for lacking a scientific basis. This thesis aims to present an approach for testing to what extent cloud based services alter or remove metadata in the images stored through such services. To exemplify what information which could potentially reveal sensitive information through image metadata, an overview of what information is publically shared will be presented, by looking at a selective section of images published on the internet through image sharing services in the cloud. The main contributions to be made through this thesis will be to provide an overview of what information regular users give away while publishing images through sharing services on the internet, either willingly or unwittingly, as well as provide an overview of how cloud based services handle Exif metadata today, along with how a forensic practitioner can verify to what extent information through a given cloud based service is reliable. Further, a methodology for testing cloud based storage services will be presented, and followed through an example using a selection of cloud based storage services to see what Exif information is altered after images are stored in the cloud. The results presented in this thesis could be practically useful for forensic practitioners as a means to demonstrate the need to carry out experiments before using information gathered through cloud services, as a business case in the scoping of a forensics assignment. Further, the results can be used by cloud service providers to help develop their cloud service to be able to aid forensics practitioners in tracing the origin of an image. The suggested approach could be used not only to test cloud based storage services in regards to image metadata, but could also be used to look at metadata in documents and other media files stored in the cloud