{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T04:12:25Z","timestamp":1750219945481,"version":"3.41.0"},"reference-count":32,"publisher":"Association for Computing Machinery (ACM)","issue":"3","license":[{"start":{"date-parts":[[2023,9,30]],"date-time":"2023-09-30T00:00:00Z","timestamp":1696032000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["Digital Threats"],"published-print":{"date-parts":[[2023,9,30]]},"abstract":"<jats:p>Due to their ease of use and their reliability, managed storage services in the cloud have become a standard way to store files for many users. Consequently, data from cloud storage services and remote file systems in general is an increasingly valuable source of digital evidence in forensic investigations. In this respect, two questions appear relevant: (1) What effect does data acquisition by the client have on the data stored on the server? (2) Does the technology support delayed verification of data acquisition? The two questions refer to critical aspects of forensic evidence collection, namely, in what way does evidence collection interfere with the evidence, and how easy is it to prove the provenance of data in a forensic investigation. We formalize the above questions and use this formalization to classify common storage services. We argue that this classification has direct consequences with regard to the probative value of data acquired from them. We, therefore, discuss the legal implications of this classification with regard to probative value so that IT expert witnesses can adapt their procedures during evidence acquisition and legal practitioners know how to assess such procedures and the evidence obtained through them from cloud storage services.<\/jats:p>","DOI":"10.1145\/3609231","type":"journal-article","created":{"date-parts":[[2023,7,14]],"date-time":"2023-07-14T12:03:29Z","timestamp":1689336209000},"page":"1-14","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":0,"title":["A Functional Classification of Forensic Access to Storage and its Legal Implications"],"prefix":"10.1145","volume":"4","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-5397-1685","authenticated-orcid":false,"given":"Andreas","family":"Hammer","sequence":"first","affiliation":[{"name":"IT Security Infrastructures Lab, Friedrich-Alexander Universit\u00e4t Erlangen-N\u00fcrnberg (FAU), Germany"}]},{"ORCID":"https:\/\/orcid.org\/0009-0004-7190-280X","authenticated-orcid":false,"given":"Mathis","family":"Ohlig","sequence":"additional","affiliation":[{"name":"Lehrstuhl f\u00fcr Strafrecht, Strafprozessrecht und Rechtsphilosophie, Friedrich-Alexander Universit\u00e4t Erlangen-N\u00fcrnberg (FAU), Germany"}]},{"ORCID":"https:\/\/orcid.org\/0009-0001-8270-1964","authenticated-orcid":false,"given":"Julian","family":"Geus","sequence":"additional","affiliation":[{"name":"IT Security Infrastructures Lab, Friedrich-Alexander Universit\u00e4t Erlangen-N\u00fcrnberg (FAU), Germany"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8279-8401","authenticated-orcid":false,"given":"Felix","family":"Freiling","sequence":"additional","affiliation":[{"name":"IT Security Infrastructures Lab, Friedrich-Alexander Universit\u00e4t Erlangen-N\u00fcrnberg (FAU), Germany"}]}],"member":"320","published-online":{"date-parts":[[2023,10,6]]},"reference":[{"key":"e_1_3_2_2_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.fsidi.2022.301443"},{"key":"e_1_3_2_3_1","volume-title":"A Comparison of Cloud Storage Technologies as Sources of Digital Evidence","author":"B\u00fcter Regine","year":"2022","unstructured":"Regine B\u00fcter, German Engst, Kai Esser, Felix Freiling, Kay Friedrich, Tim Friedrich, Andreas Hammer, Lukas Heine, Lukas Heinlein, Oliver Korn, Christian Minuth, Manuel M\u00fcller, Nico M\u00fcller, Juliane Reithmeier, Nora Ripley, Matti Schulze, Merlin Sievers, Charinee Srikhaolan, and Johan Zenk. 2022. A Comparison of Cloud Storage Technologies as Sources of Digital Evidence. Technical Report CS-2022-01. Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU), Department of Computer Science. Retrieved from https:\/\/nbn-resolving.org\/urn:nbn:de:bvb:29-opus4-210457"},{"key":"e_1_3_2_4_1","doi-asserted-by":"publisher","DOI":"10.5555\/1051914"},{"key":"e_1_3_2_5_1","volume-title":"Digital Evidence and Computer Crime\u2014Forensic Science, Computers and the Internet, 3rd Edition","author":"Casey Eoghan","year":"2011","unstructured":"Eoghan Casey. 2011. Digital Evidence and Computer Crime\u2014Forensic Science, Computers and the Internet, 3rd Edition. Academic Press. Retrieved from http:\/\/www.elsevierdirect.com\/product.jsp?isbn=9780123742681"},{"key":"e_1_3_2_6_1","unstructured":"David Coulter Michael Satran and Drew Batchelor. 2021. Microsoft SMB protocol and CIFS Protocol Overview. Retrieved from https:\/\/docs.microsoft.com\/en-us\/windows\/win32\/fileio\/microsoft-smb-protocol-and-cifs-protocol-overview. (Jan.2021). part of Windows 2000 Web and Application Services Technical Overview."},{"key":"e_1_3_2_7_1","unstructured":"Nick Craig-Wood. 2022. Rclone. Retrieved from https:\/\/rclone.org\/. (July2022)."},{"key":"e_1_3_2_8_1","unstructured":"Crown Prosecution Service. 2022. The Code for Crown Prosecutors. Expert Evidence. Legal Guidance. (Aug.2022). Retrieved from https:\/\/www.cps.gov.uk\/legal-guidance\/expert-evidence"},{"key":"e_1_3_2_9_1","first-page":"670","article-title":"SoK: Assumptions underlying cryptocurrency deanonymizations\u2014a taxonomy for scientific experts and legal practitioners","volume":"3","author":"Deuber Dominic","year":"2022","unstructured":"Dominic Deuber, Viktoria Ronge, and Christian R\u00fcckert. 2022. SoK: Assumptions underlying cryptocurrency deanonymizations\u2014a taxonomy for scientific experts and legal practitioners. Cryptology ePrint Archive, Paper 2022\/763. PoPETs 3 (2022), 670\u2013691. Retrieved from https:\/\/eprint.iacr.org\/2022\/763https:\/\/eprint.iacr.org\/2022\/763","journal-title":"Cryptology ePrint Archive, Paper 2022\/763"},{"key":"e_1_3_2_10_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.fsidi.2019.200902"},{"key":"e_1_3_2_11_1","unstructured":"German Federal Constitutional Court (BVerfG). 2008. Beschluss der 2. Kammer des Zweiten Senats vom 26. Juni 2008-2 BvR 219\/08. (June2008). Retrieved from http:\/\/www.bverfg.de\/e\/rk20080626_2bvr021908.html"},{"key":"e_1_3_2_12_1","unstructured":"German Federal Constitutional Court (BVerfG). 2011. Beschluss des Zweiten Senats vom 07. Dezember 2011-2 BvR 2500\/09. (Dec.2011). Retrieved from http:\/\/www.bverfg.de\/e\/rs20111207_2bvr250009.html"},{"key":"e_1_3_2_13_1","unstructured":"German Federal Constitutional Court (BVerfG). 2022. Press statement: Bavarian Protection of the Constitution Act unconstitutional in part. (April2022). Retrieved from https:\/\/www.bundesverfassungsgericht.de\/SharedDocs\/Pressemitteilungen\/EN\/2022\/bvg22-033.html"},{"key":"e_1_3_2_14_1","first-page":"113","article-title":"5 StR 86\/55","author":"(BGH) German Federal Court of Justice","year":"1955","unstructured":"German Federal Court of Justice (BGH). 1955. 5 StR 86\/55. BGHSt 8. (April1955), 113 pages.","journal-title":"BGHSt 8"},{"key":"e_1_3_2_15_1","first-page":"670","article-title":"Beschluss vom 5. 8. 2003-2 BJs 11\/03-5 - StB 7\/03","author":"(BGH) German Federal Court of Justice","year":"2003","unstructured":"German Federal Court of Justice (BGH). 2003. Beschluss vom 5. 8. 2003-2 BJs 11\/03-5 - StB 7\/03. NStZ 2003. (Aug.2003), 670\u2013671 pages.","journal-title":"NStZ 2003"},{"key":"e_1_3_2_16_1","first-page":"693","article-title":"Beschluss des 2. Strafsenats vom 9.1.2020-2 StR 263\/19 -","author":"(BGH) German Federal Court of Justice","year":"2020","unstructured":"German Federal Court of Justice (BGH). 2020. Beschluss des 2. Strafsenats vom 9.1.2020-2 StR 263\/19 -. NStZ 2020. (Jan.2020), 693\u2013694 pages.","journal-title":"NStZ 2020"},{"key":"e_1_3_2_17_1","first-page":"25","article-title":"5 StR 103\/21","author":"(BGH) German Federal Court of Justice","year":"2021","unstructured":"German Federal Court of Justice (BGH). 2021. 5 StR 103\/21. NStZ-RR 2021. (Nov.2021), 25 pages.","journal-title":"NStZ-RR 2021"},{"key":"e_1_3_2_18_1","article-title":"Network File System (NFS) Version 4 Protocol","author":"Haynes T.","year":"2015","unstructured":"T. Haynes and D. Noveck. 2015. Network File System (NFS) Version 4 Protocol. IETF Request for Comments 7530. (March2015).","journal-title":"IETF Request for Comments 7530"},{"key":"e_1_3_2_19_1","volume-title":"Forensic Science. An Introduction to Scientific and Investigative Techniques (3rd. ed.)","author":"James Stuart H.","year":"2009","unstructured":"Stuart H. James and Jon J. Nordby (Eds.). 2009. Forensic Science. An Introduction to Scientific and Investigative Techniques (3rd. ed.). CRC press."},{"key":"e_1_3_2_20_1","doi-asserted-by":"publisher","DOI":"10.1145\/3361216"},{"key":"e_1_3_2_21_1","doi-asserted-by":"publisher","DOI":"10.1145\/1713254.1713258"},{"key":"e_1_3_2_22_1","doi-asserted-by":"publisher","DOI":"10.1162\/154247603322493212"},{"key":"e_1_3_2_23_1","doi-asserted-by":"publisher","DOI":"10.2200\/S00738ED1V01Y201610SPT019"},{"key":"e_1_3_2_24_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2016.05.001"},{"key":"e_1_3_2_25_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-46279-0_11"},{"key":"e_1_3_2_26_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2016.01.013"},{"key":"e_1_3_2_27_1","volume-title":"Die Grundlagen der Erhebung und Verwertung Digitaler Daten als Beweismittel im Strafverfahren","author":"R\u00fcckert Christian","year":"2023","unstructured":"Christian R\u00fcckert. 2023. Die Grundlagen der Erhebung und Verwertung Digitaler Daten als Beweismittel im Strafverfahren. Mohr Siebeck. to appear."},{"key":"e_1_3_2_28_1","volume-title":"Criminalistics. An Introduction to Forensic Science (10th ed.)","author":"Saferstein Richard","year":"2011","unstructured":"Richard Saferstein. 2011. Criminalistics. An Introduction to Forensic Science (10th ed.). Pearson."},{"key":"e_1_3_2_29_1","unstructured":"U.S. Supreme Court. Mullaney v. Wilbur 421 U.S. 684 (1975). Retrieved from https:\/\/supreme.justia.com\/cases\/federal\/us\/421\/684\/"},{"key":"e_1_3_2_30_1","unstructured":"U.S. Supreme Court. 1920. Silverthorne Lumber Co. Inc. v. United States 251 U.S. 385 (1920). (Jan.1920). Retrieved from https:\/\/supreme.justia.com\/cases\/federal\/us\/251\/385\/"},{"key":"e_1_3_2_31_1","unstructured":"U.S. Supreme Court. 1939. Nardone v. United States 308 U.S. 338 (1939). (Dec.1939). Retrieved from https:\/\/supreme.justia.com\/cases\/federal\/us\/308\/338\/"},{"key":"e_1_3_2_32_1","unstructured":"U.S. Supreme Court. 1970. In re Winship 397 U.S. 358 (1970). (March1970). Retrieved from https:\/\/supreme.justia.com\/cases\/federal\/us\/397\/358\/"},{"key":"e_1_3_2_33_1","unstructured":"U.S. Supreme Court. 1993. Daubert v. Merrell Dow Pharmaceuticals Inc. 509 U.S. 579 (1993). (June1993). Retrieved from https:\/\/supreme.justia.com\/cases\/federal\/us\/509\/579\/"}],"container-title":["Digital Threats: Research and Practice"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3609231","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3609231","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T17:48:58Z","timestamp":1750182538000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3609231"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,9,30]]},"references-count":32,"journal-issue":{"issue":"3","published-print":{"date-parts":[[2023,9,30]]}},"alternative-id":["10.1145\/3609231"],"URL":"https:\/\/doi.org\/10.1145\/3609231","relation":{},"ISSN":["2692-1626","2576-5337"],"issn-type":[{"type":"print","value":"2692-1626"},{"type":"electronic","value":"2576-5337"}],"subject":[],"published":{"date-parts":[[2023,9,30]]},"assertion":[{"value":"2023-06-02","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2023-06-26","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2023-10-06","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}