Adding event reconstruction to a Cloud Forensic Readiness model

摘要: During post-event response, proactive forensics is of critical importance in any organisation when conducting digital forensic investigations cloud environments. However, there exist no reliable event reconstruction processes the that can help analysis and examination Digital Evidence (DE) aspects, during Forensic Readiness (DFR) process, as defined standard ISO/IEC 27043:2015. The problem this paper addresses lack an easy way performing process forensically ready preparation a Investigation (DFI). DFR approaches, helps pre-analysis characteristics potential security incidents. As result, authors have proposed Enhanced Cloud (ECFR) model with support future investigative technologies degree certainty. We also propose algorithm shows methodology used to reconstruct events ECFR. main focus work examine addition initially (CFR) model, by providing more enhanced detailed readiness model.