  Cloud computing has emerged as a popular computing paradigm in recent years.
However, today's cloud computing architectures often lack support for computer
forensic investigations. A key task of digital forensics is to prove the
presence of a particular file in a given storage system. Unfortunately, it is
very hard to do so in a cloud given the black-box nature of clouds and the
multi-tenant cloud models. In clouds, analyzing the data from a virtual machine
instance or data stored in a cloud storage only allows us to investigate the
current content of the cloud storage, but not the previous contents. In this
paper, we introduce the idea of building proofs of past data possession in the
context of a cloud storage service. We present a scheme for creating such
proofs and evaluate its performance in a real cloud provider. We also discuss
how this proof of past data possession can be used effectively in cloud
forensics.
