Attributing deleted data to a specific cloud user

A_F_S

Reputable
Sep 8, 2015
4
0
4,510
Hi,

I read in NIST report " Cloud Computing Forensic Science Challenges " the following :
Deletion in the cloud is often based on the deletion of nodes pointing to information in virtual instances.

I understood that when the CP decide to delete data - after the user deletion request -, the link between the user and the data will be broken and the user can not retrieve the data .
Does that mean that there is no way to recover the data ? Does the data deleted permanently immediately after the user request or it will take time ?

Can any one provide me with resources that explain this issue in details ?
 

kanewolf

Titan
Moderator
Since most commercial cloud implementations have Linux as the underlying infrastructure, looking into the behavior of Linux would be a start. But most file systems DO just delete references to space on disk and that by directly accessing the disks, data can be retrieved until it is overwritten. I think that if you are concerned about forensic access to your data, you should overwrite all user file systems before freeing your VMs.