We describe the design, implementation, and evaluation of FROSTdthree new forensic tools for the OpenStack cloud platform. Our implementation for the OpenStack cloud platform supports an Infrastructure-as-a-Service (IaaS) cloud and provides trustworthy forensic acquisition of virtual disks, API logs, and guest firewall logs. Unlike traditional acquisition tools, FROST works at the cloud management plane rather than interacting with the operating system inside the guest virtual machines, thereby requiring no trust in the guest machine. We assume trust in the cloud provider, but FROST overcomes nontrivial challenges of remote evidence integrity by storing log data in hash trees and returning evidence with cryptographic hashes. Our tools are user-driven, allowing customers, forensic examiners, and law enforcement to conduct investigations without necessitating interaction with the cloud provider. We demonstrate how FROST's new features enable forensic investigators to obtain forensically-sound data from OpenStack clouds independent of provider interaction. Our preliminary evaluation indicates the ability of our approach to scale in a dynamic cloud environment. The design supports an extensible set of forensic objectives, including the future addition of other data preser-Listing 2. Execution of the FROST API to retrieve the firewall logs of virtual machine 0a 18799f-c198-4dbb-b369-b49184e3dfbc showing traffic to ports 443 and 53 being dropped. This level of logging is exposed only to users with FROST or with provider assistance. Listing 3. Execution of the FROST API to retrieve a disk image of volume myvol-e9a5612d. The user can easily validate the integrity by comparing the checksums. J. Dykstra, A.T. Sherman / Digital Investigation 10 (2013) S87-S95 S93
Dykstra and Sherman REF present FROST, a digital forensics tool for the OpenStack cloud platform that enables the acquisition of virtual disk snapshots, API logs, and guest firewall logs.
Design and implementation of FROST: Digital forensic tools for the OpenStack cloud computing platform
Digital Investigation
Computer Science