SNAPS: Towards building snapshot based provenance system for virtual machines in the cloud environment

Recent threats in cloud show the necessity to perform forensics in the cloud environment. But performing forensic investigation in the cloud is different from traditional digital forensics. Cloud characteristics like multi-tenancy, rapid elasticity, diversity, and complexity raise additional challenges for cloud forensics. For each cloud Virtual Machine (VM), there will be several evidences like vdisk, vRAM, Snapshots, Volumes, Service logs, and VM logs. The forensic challenges differ from one evidence to the other. In this paper, we look at the challenges of snapshot acquisition and analysis. In reality, snapshots for a VM may not always exist. To increase their availability, we suggest the use of Cloud Forensic Readiness (CFR) models in which the snapshots are collected before the actual incident. The captured snapshots have to be transferred to the investigators environment via network. Since the cloud VM snapshots will be generally of huge size, transferring them elsewhere for processing may lead to the problem of data gravity. We resolve this problem by designing a framework named SNAPS (Snapshots based Provenance Aware System) which is derived from the existing spatio-temporal models and then customized to suit cloud forensic investigation. The motivation behind proposing SNAPS is to generate provenance for each object in the target virtual machine using its multiple snapshots. Moreover, SNAPS can be used to address various forensic challenges starting from simple to complex ones. Few of those were illustrated with the VM snapshots acquired from the Openstack Cloud Environment.