{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,16]],"date-time":"2026-07-16T21:34:24Z","timestamp":1784237664630,"version":"3.55.0"},"reference-count":50,"publisher":"Elsevier","isbn-type":[{"value":"9780128053034","type":"print"}],"license":[{"start":{"date-parts":[[2017,1,1]],"date-time":"2017-01-01T00:00:00Z","timestamp":1483228800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2017]]},"DOI":"10.1016\/b978-0-12-805303-4.00013-7","type":"book-chapter","created":{"date-parts":[[2017,1,7]],"date-time":"2017-01-07T23:42:15Z","timestamp":1483832535000},"page":"205-246","source":"Crossref","is-referenced-by-count":11,"title":["Cloud Storage Forensics"],"prefix":"10.1016","author":[{"given":"S.H.","family":"Mohtasebi","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"A.","family":"Dehghantanha","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"K.-K.R.","family":"Choo","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"78","reference":[{"key":"10.1016\/B978-0-12-805303-4.00013-7_bb0010","doi-asserted-by":"crossref","unstructured":"P. Mell, T. Grance, The NIST Definition of Cloud Computing Recommendations of the National Institute of Standards and Technology, \u200bThe National Institute of Standards and Technology, U.S Department of Commerce, 2011, http:\/\/nvlpubs.nist.gov\/nistpubs\/Legacy\/SP\/nistspecialpublication800-145.pdf.","DOI":"10.6028\/NIST.SP.800-145"},{"key":"10.1016\/B978-0-12-805303-4.00013-7_bb0015","first-page":"190","article-title":"Forensics investigation challenges in cloud computing environments","author":"Damshenas","year":"2012"},{"key":"10.1016\/B978-0-12-805303-4.00013-7_bb0020","unstructured":"The National Institute of Standards and Technology, NIST Cloud Computing Forensic Science Challenges (Draft), 2014, http:\/\/safegov.org\/media\/72648\/nist{\\_}digital{\\_}forensics{\\_}draft{\\_}8006.pdf."},{"issue":"4","key":"10.1016\/B978-0-12-805303-4.00013-7_bb0025","first-page":"76","article-title":"Cloud forensics issues and opportunities","volume":"4","author":"Aminnezhad","year":"2013","journal-title":"Int. J. Inf. Process. Manage."},{"issue":"9","key":"10.1016\/B978-0-12-805303-4.00013-7_bb0030","first-page":"543","article-title":"Cloud computing and conflicts with digital forensic investigation","volume":"7","author":"Damshenas","year":"2014","journal-title":"Int. J. Digit. Content Technol. Appl."},{"issue":"4","key":"10.1016\/B978-0-12-805303-4.00013-7_bb0035","first-page":"183","article-title":"A review on impacts of cloud computing and digital forensics","volume":"3","author":"Daryabar","year":"2014","journal-title":"Int. J. Cyber-Sec. Digit. Forensics"},{"key":"10.1016\/B978-0-12-805303-4.00013-7_bb0040","unstructured":"G. Hogben, M. Dekker, Procure secure: A guide to monitoring of security service levels in cloud contracts, European Union Agency for Network and Information Security, 2012."},{"issue":"2","key":"10.1016\/B978-0-12-805303-4.00013-7_bb0045","doi-asserted-by":"crossref","first-page":"152","DOI":"10.1016\/j.clsr.2013.01.006","article-title":"Cloud computing and its implications for cybercrime investigations in Australia","volume":"29","author":"Hooper","year":"2013","journal-title":"Comp. Law Sec. Rev."},{"key":"10.1016\/B978-0-12-805303-4.00013-7_bb0050","series-title":"Cloud Storage Forensics","author":"Quick","year":"2013"},{"issue":"4","key":"10.1016\/B978-0-12-805303-4.00013-7_bb0055","first-page":"10","article-title":"A survey on malware propagation, analysis and detection","volume":"2","author":"Damshenas","year":"2013","journal-title":"Int. J. Cyber-Sec. Digit. Forensics"},{"issue":"3","key":"10.1016\/B978-0-12-805303-4.00013-7_bb0060","first-page":"645","article-title":"Investigation of malware defence and detection techniques","volume":"1","author":"Daryabar","year":"2011","journal-title":"Int. J. Digit. Inf. Wireless Commun."},{"issue":"4","key":"10.1016\/B978-0-12-805303-4.00013-7_bb0065","first-page":"311","article-title":"A survey on privacy issues in digital forensics","volume":"1","author":"Aminnezhad","year":"2012","journal-title":"Int. J. Cyber-Sec. Digit. Forensics"},{"issue":"8","key":"10.1016\/B978-0-12-805303-4.00013-7_bb0070","first-page":"57","article-title":"A survey on privacy impacts of digital investigation","volume":"4","author":"Daryabar","year":"2013","journal-title":"J. Next Gener. Inf. Technol."},{"key":"10.1016\/B978-0-12-805303-4.00013-7_bb0075","first-page":"129","article-title":"Privacy-respecting digital investigation","author":"Dehghantanha","year":"2014"},{"issue":"4","key":"10.1016\/B978-0-12-805303-4.00013-7_bb0080","doi-asserted-by":"crossref","first-page":"20","DOI":"10.1109\/MCC.2014.69","article-title":"Cloud forensic technical challenges and solutions: a snapshot","volume":"1","author":"Martini","year":"2014","journal-title":"IEEE Cloud Comput."},{"issue":"2","key":"10.1016\/B978-0-12-805303-4.00013-7_bb0085","doi-asserted-by":"crossref","first-page":"81","DOI":"10.1016\/j.diin.2012.05.015","article-title":"Digital forensic investigation of cloud storage services","volume":"9","author":"Chung","year":"2012","journal-title":"Digit. Investig."},{"key":"10.1016\/B978-0-12-805303-4.00013-7_bb0090","first-page":"4910","article-title":"Using smartphones as a proxy for forensic evidence contained in cloud storage services","author":"Grispos","year":"2013"},{"issue":"1","key":"10.1016\/B978-0-12-805303-4.00013-7_bb0095","doi-asserted-by":"crossref","first-page":"30","DOI":"10.1016\/j.diin.2014.02.002","article-title":"Cloud Data Imager: a unified answer to remote acquisition of cloud storage areas","volume":"11","author":"Federici","year":"2014","journal-title":"Digit. Investig."},{"issue":"4","key":"10.1016\/B978-0-12-805303-4.00013-7_bb0100","doi-asserted-by":"crossref","first-page":"287","DOI":"10.1016\/j.diin.2013.08.005","article-title":"Cloud storage forensics: ownCloud as a case study","volume":"10","author":"Martini","year":"2013","journal-title":"Digit. Investig."},{"issue":"3","key":"10.1016\/B978-0-12-805303-4.00013-7_bb0105","doi-asserted-by":"crossref","first-page":"259","DOI":"10.1016\/j.diin.2013.04.006","article-title":"Amazon cloud drive forensic analysis","volume":"10","author":"Hale","year":"2013","journal-title":"Digit. Investig."},{"key":"10.1016\/B978-0-12-805303-4.00013-7_bb0110","series-title":"Cloud Security Ecosystem","first-page":"309","article-title":"Mobile cloud forensics: an analysis of seven popular android apps","author":"Martini","year":"2015"},{"key":"10.1016\/B978-0-12-805303-4.00013-7_bb0115","first-page":"111","article-title":"A case study on digital forensics in the cloud","author":"Marturana","year":"2012"},{"key":"10.1016\/B978-0-12-805303-4.00013-7_bb0120","doi-asserted-by":"crossref","first-page":"S106","DOI":"10.1016\/j.diin.2014.05.006","article-title":"A forensically robust method for acquisition of iCloud data","volume":"11","author":"Oestreicher","year":"2014","journal-title":"Digit. Investig."},{"key":"10.1016\/B978-0-12-805303-4.00013-7_bb0125","first-page":"1","article-title":"Data reduction and data mining framework for digital forensic evidence: storage, intelligence, review, and archive","volume":"480","author":"Quick","year":"2014","journal-title":"Trends Issues Crime Crim. Justice"},{"key":"10.1016\/B978-0-12-805303-4.00013-7_bb0130","doi-asserted-by":"crossref","first-page":"179","DOI":"10.1016\/j.jnca.2013.09.016","article-title":"Google Drive: forensic analysis of data remnants","volume":"40","author":"Quick","year":"2014","journal-title":"J. Netw. Comput. Appl."},{"issue":"1","key":"10.1016\/B978-0-12-805303-4.00013-7_bb0135","doi-asserted-by":"crossref","first-page":"3","DOI":"10.1016\/j.diin.2013.02.003","article-title":"Dropbox analysis: data remnants on user machines","volume":"10","author":"Quick","year":"2013","journal-title":"Digit. Investig."},{"issue":"6","key":"10.1016\/B978-0-12-805303-4.00013-7_bb0140","doi-asserted-by":"crossref","first-page":"1378","DOI":"10.1016\/j.future.2013.02.001","article-title":"Digital droplets: Microsoft SkyDrive forensic data remnants","volume":"29","author":"Quick","year":"2013","journal-title":"Futur. Gener. Comput. Syst."},{"issue":"3","key":"10.1016\/B978-0-12-805303-4.00013-7_bb0145","doi-asserted-by":"crossref","first-page":"266","DOI":"10.1016\/j.diin.2013.07.001","article-title":"Forensic collection of cloud storage data: does the act of collection result in changes to the data or its metadata?","volume":"10","author":"Quick","year":"2013","journal-title":"Digit. Investig."},{"key":"10.1016\/B978-0-12-805303-4.00013-7_bb0150","series-title":"Cloud Security Ecosystem","first-page":"429","article-title":"Ubuntu one investigation: detecting evidences on client machines","author":"Shariati","year":"2015"},{"key":"10.1016\/B978-0-12-805303-4.00013-7_bb0155","first-page":"536","article-title":"Cloud storage forensic: hubiC as a case-study","author":"Blakeley","year":"2015"},{"issue":"1","key":"10.1016\/B978-0-12-805303-4.00013-7_bb0160","doi-asserted-by":"crossref","first-page":"95","DOI":"10.1080\/00450618.2015.1021379","article-title":"SugarSync forensic analysis","volume":"48","author":"Shariati","year":"2016","journal-title":"Aust. J. Forensic Sci."},{"key":"10.1016\/B978-0-12-805303-4.00013-7_bb0165","article-title":"Cloud storage forensics: MEGA as a case study","author":"Daryabar","year":"2016","journal-title":"Aust. J. Forensic Sci."},{"key":"10.1016\/B978-0-12-805303-4.00013-7_bb0170","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1080\/00450618.2016.1153714","article-title":"Forensic investigation of OneDrive, Box, GoogleDrive and Dropbox applications on Android and iOS devices","author":"Daryabar","year":"2016","journal-title":"Aust. J. Forensic Sci."},{"issue":"3","key":"10.1016\/B978-0-12-805303-4.00013-7_bb0175","first-page":"83","article-title":"Cyber forensic for Hadoop based cloud system","volume":"6","author":"Cho","year":"2012","journal-title":"Int. J. Sec. Appl."},{"key":"10.1016\/B978-0-12-805303-4.00013-7_bb0180","doi-asserted-by":"crossref","first-page":"S90","DOI":"10.1016\/j.diin.2012.05.001","article-title":"Acquiring forensic evidence from infrastructure-as-a-service cloud computing: exploring and evaluating tools, trust, and techniques","volume":"9","author":"Dykstra","year":"2012","journal-title":"Digit. Investig."},{"key":"10.1016\/B978-0-12-805303-4.00013-7_bb0185","first-page":"935","article-title":"Remote programmatic vCloud forensics: a six-step collection process and a proof of concept","author":"Martini","year":"2014"},{"issue":"4","key":"10.1016\/B978-0-12-805303-4.00013-7_bb0190","doi-asserted-by":"crossref","first-page":"295","DOI":"10.1016\/j.diin.2014.08.002","article-title":"Distributed filesystem forensics: XtreemFS as a case study","volume":"11","author":"Martini","year":"2014","journal-title":"Digit. Investig."},{"key":"10.1016\/B978-0-12-805303-4.00013-7_bb0195","first-page":"110","article-title":"Digital forensics for Eucalyptus","author":"Zafarullah","year":"2011"},{"issue":"3","key":"10.1016\/B978-0-12-805303-4.00013-7_bb0200","doi-asserted-by":"crossref","first-page":"270","DOI":"10.1007\/s12117-008-9038-9","article-title":"Organized crime groups in cyberspace: a typology","volume":"11","author":"Choo","year":"2008","journal-title":"Trends Organ. Crime"},{"issue":"3","key":"10.1016\/B978-0-12-805303-4.00013-7_bb0205","doi-asserted-by":"crossref","first-page":"270","DOI":"10.1007\/s12117-008-9038-9","article-title":"Criminal exploitation of online systems by organized crime groups","volume":"11","author":"Choo","year":"2008","journal-title":"Trends Organ. Crime"},{"key":"10.1016\/B978-0-12-805303-4.00013-7_bb0210","unstructured":"Net Applications, Mobile\/tablet operating system market share, 2014. Available online at: https:\/\/www.netmarketshare.com\/operating-system-market-share.aspx?qprid=8&qpcustomd=1 (accessed 30 June 16)."},{"key":"10.1016\/B978-0-12-805303-4.00013-7_bb0215","unstructured":"Desktop operating system market share, 2014. Available online at: https:\/\/www.netmarketshare.com\/ operating-system-market-share.aspx?qprid=10&qpcustomd=0 (accessed 30 June 16)."},{"key":"10.1016\/B978-0-12-805303-4.00013-7_bb0220","unstructured":"J. Williams, ACPO good practice guide for digital evidence, Association of Chief Police Officers, 2012."},{"issue":"2","key":"10.1016\/B978-0-12-805303-4.00013-7_bb0225","doi-asserted-by":"crossref","first-page":"71","DOI":"10.1016\/j.diin.2012.07.001","article-title":"An integrated conceptual digital forensic framework for cloud computing","volume":"9","author":"Martini","year":"2012","journal-title":"Digit. Investig."},{"key":"10.1016\/B978-0-12-805303-4.00013-7_bb0230","first-page":"1475","article-title":"Digital forensics investigations in the cloud","author":"Thethi","year":"2014"},{"key":"10.1016\/B978-0-12-805303-4.00013-7_bb0235","series-title":"Technical Report","article-title":"Guide to integrating forensic techniques into incident response","author":"Kent","year":"2006"},{"key":"10.1016\/B978-0-12-805303-4.00013-7_bb0240","unstructured":"VMware Inc., VMware Workstation 5.5. What files make up a virtual machine? VMware Inc. Available online at: https:\/\/www.vmware.com\/support\/ws55\/doc\/ws_learning_files_in_a_vm.html, 2016 (accessed 30 June 16)."},{"key":"10.1016\/B978-0-12-805303-4.00013-7_bb0245","unstructured":"B. Carrier, Digital forensics tool testing image (#8), 2004. Available online at: http:\/\/dftt.sourceforge.net\/test8\/index.html (accessed 30 July 16)."},{"key":"10.1016\/B978-0-12-805303-4.00013-7_bb0250","series-title":"Forensic Analysis of the ESE Database in Internet Explorer 10","author":"Malmstr\u00f6m","year":"2013"},{"key":"10.1016\/B978-0-12-805303-4.00013-7_bb0255","unstructured":"C. Wilson, DCode Date, Free Digital Forensic Tools, Available online: http:\/\/www.digital-detective.net\/digital- forensic-software\/free-tools\/, 2016 (accessed 30 July 16)."}],"container-title":["Contemporary Digital Forensic Investigations of Cloud and Mobile Applications"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:B9780128053034000137?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:B9780128053034000137?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2019,9,17]],"date-time":"2019-09-17T08:17:20Z","timestamp":1568708240000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/B9780128053034000137"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2017]]},"ISBN":["9780128053034"],"references-count":50,"URL":"https:\/\/doi.org\/10.1016\/b978-0-12-805303-4.00013-7","relation":{},"subject":[],"published":{"date-parts":[[2017]]}}}