Journal of the Korea Institute of Information and Communication Engineering (한국정보통신학회논문지)

The Korea Institute of Information and Commucation Engineering (한국정보통신학회)
권호 표지
DOI QR코드

DOI QR Code

An Analysis of Google Cloud Data from a Digital Forensic Perspective

디지털 포렌식 관점에서의 구글 클라우드 데이터 분석 연구

  • Kim, Dohyun (Department of Computer Science, Catholic University of Pusan) ;
  • Kim, Junki (School of Cybersecurity, Korea University) ;
  • Lee, Sangjin (School of Cybersecurity, Korea University)
  • Received : 2020.06.21
  • Accepted : 2020.06.29
  • Published : 2020.12.31
Download PDF
⟨ Previous Next ⟩

Abstract

Google cloud includes data uploaded and synchronized by users, as well as synchronization history of all cloud services, users' smartphone usage, and location information. Therefore, Google cloud data can be useful for digital forensics from a user behavior analysis perspective. Through this paper, we have identified the types of cloud data that can be acquired using Google's Takeout service and developed a tool that can be usefully utilized in digital forensics research and investigation by screening and analyzing the data required for analyzing user behavior. Because Google cloud data is synchronized through Google accounts regardless of the type of computing device, Google service data used on various devices such as PCs, smartphones, and tablet PCs can be acquired through Google accounts without the device. Therefore, the results of this paper's research are expected to be very useful for digital forensics research and investigation in the current situation.

구글 클라우드는 사용자가 업로드 및 동기화한 파일과 데이터뿐만 아니라 모든 클라우드 서비스들의 동기화 내역과 사용자의 스마트폰 사용 내역, 위치 정보 등도 포함하기 때문에 사용자 행위 분석 관점에서 디지털 포렌식 조사에 유용하게 사용할 수 있다. 우리는 본 논문을 통해 구글의 Takeout 서비스를 사용하여 수집 가능한 클라우드 데이터의 종류를 확인했고, 사용자 행위 분석에 필요한 데이터를 선별 및 분석하여 디지털 포렌식 연구와 조사에서 유용하게 활용할 수 있는 도구를 개발했다. 구글 클라우드 데이터는 컴퓨팅 기기의 종류와 상관없이 구글 계정을 통해 동기화 되기 때문에 PC, 스마트폰, 태블릿 PC 등 다양한 기기에서 사용한 구글 서비스 데이터를 해당 기기가 없어도 구글 계정을 통해 수집할 수 있다. 따라서 본 논문의 연구 결과는 모바일 기기의 정보보호 기술의 발전으로 인해 데이터 수집이 어려워지고 있는 상황에서 디지털 포렌식 연구 및 조사에 매우 유용하게 활용할 수 있을 것으로 기대된다.

Keywords

References

  1. Cisco Visual Networking Index: Forecast and Trends, 2017 -2022 [Internet]. Available: https://davidellis.ca/wp-content/uploads/2019/05/cisco-vni-feb2019.pdf/.
  2. Current and planned usage of public cloud platform services running applications worldwide as of 2020 [Internet]. Available: https://www.statista.com/statistics/511467/worldwide-survey-public-coud-services-running-application/.
  3. Purposes for personal cloud service usage in South Korea in 2019 [Internet]. Available: https://www.statista.com/statistics/1013119/south-korea-cloud-service-use-personal-purpose/.
  4. Purposes for work-related cloud service usage in South Korea in 2019 [Internet]. Available: https://www.statista.com/statistics/1013121/south-korea-cloud-service-use-work-related-purpose/.
  5. Google Takeout [Internet]. Available: https://takeout.google.com/.
  6. X. Yu, A. L. Stuart, Y. Liu, C. E. Ivey, A. G. Russell, H. Kan, L. R. Henneman, S. E. Sarnat, S. Hasan, A. Sadmani, and X. Yang, "On the accuracy and potential of Google Maps location history data to characterize individual mobility for air pollution health studies," Environmental Pollution, vol. 252(A), pp. 924-930, 2019. https://doi.org/10.1016/j.envpol.2019.05.081
  7. M. Lochtefeld, "DetourNavigator - Using Google Location History to Generate Unfamiliar Personal Routes," Extended Abstracts of the 2019 CHI Conference on Human Factors in Computing Systems (CHI EA '19), Paper LBW1117, pp. 1-6, 2019.
  8. H. Chung, J. Park, S. Lee, and C. Kang, "Digital forensic investigation of cloud storage services," Digital Investigation, vol. 9, no. 2, pp. 81-94, 2012. https://doi.org/10.1016/j.diin.2012.05.015
  9. D. Quick and K. K. R. Choo, "Google Drive: Forensic analysis of data remnants," Journal of Network and Computer Applications, vol. 40, pp. 179-193, 2014. https://doi.org/10.1016/j.jnca.2013.09.016
  10. C. Federici, "Cloud Data Imager: A unified answer to remote acquisition of cloud storage areas," Digital Investigation, vol. 11, no. 1, pp. 30-42, 2014. https://doi.org/10.1016/j.diin.2014.02.002
  11. E. Williams and J. Yerby, "Google and Facebook Data Retention and Location Tracking through Forensic Cloud Analysis," Southern Association for Information Systems (SAIS), 2019.
  12. M. E. Alex and R. Kishore, "Forensics framework for cloud computing," Computers & Electrical Engineering, vol. 60, pp. 193-205, 2017. https://doi.org/10.1016/j.compeleceng.2017.02.006
  13. D. Birk and C. Wegener, "Technical issues of forensic investigations in cloud computing environments," 2011 Sixth IEEE International Workshop on Systematic Approaches to Digital Forensic Engineering. IEEE, pp. 1-10, 2011.
  14. B. Manral, G. Somani, K. K. R. Choo, M. Conti, and M. S. Gaur, "A systematic survey on cloud forensics challenges, solutions, and future directions," ACM Computing Surveys (CSUR), vol. 52, no. 6, pp. 1-38, 2019.
  15. D. Kim and S. Lee, "A Study on the Usage of Investigation of Google Cloud Data (Smartphone user-oriented)," Journal of Digital Forensics, vol. 12, no. 3, pp. 107-118, 2018.
  16. Material Design Lite [Internet]. Available: https://getmdl.io/.
  17. Bing maps [Internet]. Available: https://www.bing.com/api/maps/sdk/mapcontrol/isdk/loadmapasync/.

Cited by

  1. File Signature's Automatic Calculation Algorithm Proposal for Digital Forensic vol.13, pp.3, 2020, https://doi.org/10.7236/ijibc.2021.13.3.118
  2. 디지털 포렌식을 위한 SHA-256 활용 데이터 수정 감지시스템 제안 vol.21, pp.4, 2021, https://doi.org/10.7236/jiibc.2021.21.4.9