AlmaNebula: A Computer Forensics Framework for the Cloud

Scalability, fault tolerance and collaborative processing across possibly dispersed sites are key enablers of modern computer forensics applications, that must be able to elastically accommodate all kinds of digital investigations, without wasting resources or fail to deliver timely outcomes. Traditional tools running in a standalone or client- server setups may fall short when handling the multi terabyte scale of a case just above average or, conversely, lie mainly underutilized when dealing with few digital evidences. A new category of applications that leverage the opportunities offered by modern Cloud Computing (CC) platforms, where scalable computational power and storage capacity can be engaged and decommissioned on demand, allow one to conveniently master huge amounts of information that otherwise could be impossible to wield. This paper discusses the design goals, technical requirements and architecture of AlmaNebula, a conceptual framework for the analysis of digital evidences built on top of a Cloud infrastructure, which aims to embody the concept of “Forensics as a service”.