Department of Computer Science and Engineering, MNIT, Jaipur 302017, India.
Faculty of Electrical and Computer Engineering, Arba Minch University, Arba Minch, Ethiopia.
J Healthc Eng. 2022 Mar 16;2022:9709101. doi: 10.1155/2022/9709101. eCollection 2022.
Cloud computing is widely used in various sectors such as finance, health care, and education. Factors such as cost optimization, interoperability, data analysis, and data ownership functionalities are attracting healthcare industry to use cloud services. Security and forensic concerns are associated in cloud environments as sensitive healthcare data can attract the outside attacker and inside malicious events. Storage is the most used service in cloud computing environments. Data stored in iCloud (Apple Inc. Cloud Service Provider) is accessible via a Web browser, cloud client application, or mobile application. Apple Inc. provides iCloud service to synchronize data from MacBook, iPhone, iPad, etc. Core applications such as Mail, Contacts, Calendar, Photos, Notes, Reminders, and Keynote are synced with iCloud. Various operations can be performed on cloud data, including editing, deleting, uploading, and downloading data, as well as synchronizing data between devices. These operations generate log files and directories that are essential from an investigative perspective. This paper presents a taxonomy of iCloud forensic tools that provides a searchable catalog for forensic practitioners to identify the tools that meet their technical requirements. A case study involving healthcare data storage on iCloud service demonstrates that artifacts related to environmental information, browser activities (history, cookies, cache), synchronization activities, log files, directories, data content, and iCloud user activities are stored on a MacBook system. A GUI-based dashboard is developed to support iCloud forensics, specifically the collection of artifacts from a MacBook system.
云计算在金融、医疗保健和教育等各个领域得到了广泛应用。成本优化、互操作性、数据分析和数据所有权功能等因素吸引了医疗保健行业使用云服务。在云环境中存在安全和取证方面的问题，因为敏感的医疗保健数据可能会吸引外部攻击者和内部恶意事件。存储是云计算环境中使用最广泛的服务。存储在 iCloud（苹果公司的云服务提供商）中的数据可以通过 Web 浏览器、云客户端应用程序或移动应用程序访问。苹果公司提供 iCloud 服务来同步 MacBook、iPhone、iPad 等设备的数据。邮件、联系人、日历、照片、笔记、提醒和 Keynote 等核心应用程序与 iCloud 同步。可以对云数据执行各种操作，包括编辑、删除、上载和下载数据，以及在设备之间同步数据。这些操作会生成日志文件和目录，这对于调查人员来说非常重要。本文提出了一种 iCloud 取证工具分类法，为取证从业人员提供了一个可搜索的目录，以便确定符合其技术要求的工具。一项涉及 iCloud 服务上存储的医疗保健数据的案例研究表明，与环境信息、浏览器活动（历史记录、Cookie、缓存）、同步活动、日志文件、目录、数据内容和 iCloud 用户活动相关的项都存储在 MacBook 系统上。开发了一个基于 GUI 的仪表板来支持 iCloud 取证，特别是从 MacBook 系统中收集项。
