Cloud forensics research -
In chronological order, most recent to oldest
@inproceedings{OrtonLegalCloud,
Author = {Ivan Orton and Aaron Alva and Barbara Endicott-Popovsky}, title = {Legal Process and Requirements for Cloud Forensic Investigations}, booktitle = {Cybercrime and Cloud Forensics: Applications for Investigation Processes}, Editor = {K. Ruan}, Pages = {186-229}, Publisher = {IGI Global}, Year = {2013}, url = {https://www.ssrn.com/abstract=2197978}}
@inproceedings{DykstraSeizing,
Author = {Josiah Dykstra}, title = {Seizing Electronic Evidence from Cloud Computing Environments}, booktitle = {Cybercrime and Cloud Forensics: Applications for Investigation Processes}, Editor = {K. Ruan}, Publisher = {IGI Global}, Year = {2013}}
@inproceedings{dykstra-frost,
title="Digital Forensic Tools for the OpenStack Cloud Computing Platform", year=2013, author="Josiah Dykstra and Alan T. Sherman", booktitle="DFRWS 2013", url="https://dfrws.org/sites/default/files/session-files/2013_USA_paper-design_and_implementation_of_frost_-_digital_forensic_tools_for_the_openstack_cloud_computing_platform.pdf",
location="Monterey, CA",
publisher="Elsevier"
} 
@book{Ruan13,
title="Cybercrime and Cloud Forensics: Applications for Investigation Processes", author={Keyun Ruan}, year={2013}, publisher={IGI Global}, url = {https://www.igi-global.com/book/cybercrime-cloud-forensics/69206}
} 
@article{DykstraJOLT,
author = "Josiah Dykstra and Damien Riehl", title = "Forensic Collection of Electronic Evidence from Infrastructure-As-a-Service Cloud Computing", journal = "Richmond Journal of Law and Technology", volume = {19}, issue = {1}, year = {2012}, url="https://redirect.cs.umbc.edu/~dykstra/Final-Dykstra-Riehl-1.pdf"
@article{Poisel2012,
title="Discussion on the Challenges and Opportunities of Cloud Forensics", author="Rainer Poisel and Simon Tjoa", journal="Multidisciplinary Research and Practice for Information Systems", pages={593--608}, year={2012}, publisher={Springer}
@article{Grispos12,
author = "George Grispos and Tim Storer and William Bradley Glisson", title = "Calm Before the Storm: The Challenges of Cloud Computing in Digital Forensics", journal = "International Journal of Digital Crime and Forensics", volume = {4},, issue = {2}, year = {2012}, url="https://www.dcs.gla.ac.uk/~grisposg/Papers/calm.pdf"
@article{Dykstra12,
author = "Josiah Dykstra and Alan T. Sherman", title = "Acquiring forensic evidence from infrastructure-as-a-service cloud computing: Exploring and evaluating tools, trust, and techniques", journal = "Digital Investigation", volume = {9}, year = {2012}, pages = {S90--S98}, url="https://www.sciencedirect.com/science/article/pii/S1742287612000266"
@inproceedings{AlvaSADFE,
Author = {Aaron Alva and Scott David and Barbara Endicott-Popovsky}, title = {Forensic Barriers: Legal Implications of Storing and Processing Information in the Cloud}, booktitle = {Proceedings of the 7th International Workshop on Systematic Approaches to Digital Forensic Engineering (SADFE)}, Year = {2012} address = {Vancouver, BC}}
@inproceedings{ISSA,
author = "Waldo Delport and Michael Kohn and Martin S. Olivier", title = "Isolating a cloud instance for a digital forensic investigation", booktitle={Proceedings of the 2011 Information Security for South Africa (ISSA 2011) Conference}, year={August 2011}, organization={ISSA},
@article{CLSR,
author = "Esther George and Stephen Mason", title = "Digital evidence and ‘cloud’ computing", journal = "Computer Law & Security Review", volume = {27}, issue = {5}, year = {September 2011}, pages = {524--528}
@article{dykstraJournal,
author = "Josiah Dykstra and Alan. T. Sherman", title = "Understanding Issues in Cloud Forensics: Two Hypothetical Case Studies", journal ={Journal of Network Forensics}, volume = {3}, number = {1}, year = {Autumn, 2011}, pages = {19--31}
} 
@article{ruan,
title="Cloud forensics: An overview", author={Keyun Ruan and Joe Carthy and Tahar Kechadi and Mark Crosbie}, booktitle={Advances in Digital Forensics VII}, year={2011},
}
@inproceedings{ruanSurvey,
title="Survey on cloud forensics and critical criteria for cloud forensic capability: A preliminary analysis", author={Keyun Ruan and Ibrahim Baggili and Joe Carthy and Tahar Kechadi}, booktitle={Proceedings of the 2011 ADFSL Conference on Digital Forensics, Security and Law}, year={2011}, organization={ADFSL},
} 
@article{CloudForensics,
author = {Mark Taylor and John Haggerty and David Gresty and David Lamb}, title = {Forensic investigation of cloud computing systems}, journal ={Network Security}, volume = {2011}, number = {3}, year = {2011}, pages = {4--10}, url="https://www.whieb.com/download.jsp?address=/upload%2Fdoc%2F20110415%2Fforensic+investigation+of+cloud+computing+systems.pdf"
}
@inproceedings{birk,
title="Technical Issues of Forensic Investigations in Cloud Computing Environments", booktitle = {Proceedings of the 6th International Workshop on Systematic Approaches to Digital Forensic Engineering (SADFE)}, author={Dominik Birk and Christoph Wegener}, year={2011}, organization={IEEE}, address = {Oakland, CA, USA},
}
@article{Araiza11,
title="Electronic Discovery in the Cloud", author={Alberto G. Araiza}, journal={Duke Law and Technology Review}, volume = {8}, year = {2011},
} 
@article{Cross10,
title="E-Discovery and Cloud Computing: Control of ESI in the Cloud", author={David D. Cross and Emily Kuwahara}, journal={EDDE Journal}, volume = {1}, number = {2}, year = {2010}, pages = {2--12},
} 
@book{Lil10,
title="Digital Forensics for Network, Internet and Cloud Computing: A Forensic Evidence Guide for Moving Targets and Data", author={Terrance V. Lillard}, year={2010}, publisher={Syngress},
} 
@inproceedings{Lu10,
title="Secure provenance: the essential of bread and butter of data forensics in cloud computing", booktitle={Proceedings of the 5th ACM Symposium on Information, Computer and Communications Security (ASIACCS '10)}, author={Rongxing Lu and Xiaodong Lin and Xiaohui Liang and Xuemin Sherman Shen}, pages={282--292}, year={2010}, address={New York, NY, USA}, organization={ACM}, url="https://dl.acm.org/doi/10.1145/1755688.1755723"
}
@inproceedings{Wol09,
title="Overcast: Forensic Discovery in Cloud Environments", booktitle = {Proceedings of the 2009 Fifth International Conference on IT Security Incident Management and IT Forensics (IMF '09)}, author={Stephen D. Wolthusen}, pages={3--9}, year={2009}, address={Washington, DC, USA}, organization={IEEE Computer Society}
}