I'm new to forensic and I'm trying to do a simple research about forensic in the cloud.
let's assume that I have access to an EC2 instance (whether a private key for a Linux instance or the username and password for Windows instance), and I used a software like FTK Remote Agent to acquire an image. Isn't this image the same as if I was able to go to the data center and physically connect and acquire the image?
I'm asking this because I was reading a paper in which the researchers were evaluating current tools (like FTK and EnCase) in cloud environment.They wanted to know whether these tools can acquire forensic data. So they created an EC2 instance, downloaded Apache on that instance, made some web pages and compromised the machine using a web-based vulnerability. Then they acquired an image and checked if they can find the timeline of their activities.
My other question: is it considered acceptable to install a tool or a service on a remote machine in order to acquire a forensic image? or is it considered to be damaging to the integrity of the evidence? (for example connecting to an EC2 instance using remote desktop and installing a tool that would let me connect to acquire a remote image).
Thanks.
Aucun commentaire:
Enregistrer un commentaire