In other words, as the degree of control of the CSCs decreases, less forensic data is available for CSCs.
The authors now try to complete the model for bilateral cloud forensics by combining the component services with execution of the CCRP. Figure 6 shows the model when forensic data is collected at both CSCs and CSPs (as in Fig. 4).
All the statistical analyses of forensic data were performed as described by Brenner [ 9] and using DNAVIEW™ 27.19.
The retrieved forensic data were used for subsequent multi-parametric analysis focusing on the evaluation of circumstances, mechanisms and causes of death in the cases of women who met the basic selection criteria.
Demographic (age, gender, nationality, intelligence) and forensic data were obtained using the Basel Catalogue for Risk Assessment (BCRA) [ 20], the Historical Clinical Risk Assessment (HCR-20) [ 21], and the Psychopathy Checklist-screening version (PCL-SV) [ 22].
Hence, the FDC is a piece of software that is possibly in combination with some hardware components which are used to collect and store the forensic data that are crucial for an incident under investigation.
This approach leads to two fundamental issues: (i) how do the CSCs and CSPs collect the forensic data that are essential to compute unilaterally trusted outputs that can form the basis for agreement on the forensic investigation, and (ii) how do the CSCs and CSPs resolve conflicts over a forensic investigation.
These forensic data, which are at the custody of the CSPs may include system logs, application logs, user authentication and access information, database logs etc. CSPs side forensic data may also include virtual disk data and physical memory data pertaining to particular virtual machine, host logs and Application Programming Interface (API) logs.
Unlike other areas of digital forensics network data is often volatile and rarely logged, making the discipline often reactionary.
