A study on identity-authentication and evidence-investigation for cloud forensics

近年來雲端服務、大數據、物聯網等技術相繼崛起發展，使得人們生活越加便利。雲端服務不僅為行動用戶帶來遠端存取資料的契機，也造成犯罪者能將犯罪資訊儲存於雲端，以便遠端存取犯罪事證，並降低自身攜有犯罪資料的風險。面對這樣的犯罪趨勢，本研究將提出一套以鑑識調查為目的的雲端鑑識機制，透過這樣的機制可保留關鍵證據，同時要能抵禦惡意外在攻擊，避免從雲端服務所萃取出來的證據遭受質疑。另外我們將針對iOS裝置上的雲端服務進行鑑識研究，透過網路分析、檔案分析及動態分析等3種分析方法，澈底瞭解在iOS裝置上所能發現的數位證據。Recently, the technology development of cloud service, big data, and IoT has improved our life more and more convenience than before. Cloud service not only makes users to access data remotely, but also makes criminals to save the data of criminal in cloud, they can access the criminal evidence remotely, and reduce the risk of keeping the criminal data by themselves. This paper proposes a scheme of cloud forensics investigation, which could defend the cloud system from the outside offender, and forensically the evidence collect from the cloud service. The cloud storage forensics on iOS devices is further analyzed from the following three analysis methods, network packet analysis, file analysis, and APP runtime analysis. It will thoroughly help us explore digital evidence we