A Residual-Artifact-Based Assessment of Forensic Reconstruction Capability After Anti-Forensic Cloud Manipulation

Cloud evidence is commonly spread across object data, versions, audit records, metadata, and other service-generated traces. This distribution becomes a forensic concern when an actor deliberately changes or removes evidence-bearing information. The RAAF-CF study evaluates what can still be reconstructed from residual artifacts after five controlled anti-forensic conditions: deletion with a retained version (E1), deletion without retained content (E2), timestamp manipulation (E3), event-identifier manipulation (E4), and combined anti-forensics (E5). Six evidence dimensions are assessed separately: content, history, temporal information, event identity, metadata, and object state. The investigation follows Detect → Acquire → Correlate → Reconstruct → Verify and evaluates artifact availability, consistency, and independence before assigning reconstruction labels. SHA-256 values are used for reproducible byte-level integrity and artifact-relationship checks. Reconstruction is classified as Fully Reconstructable (FR), Partially Reconstructable (PR), Not Reconstructable (NR), or Not Evaluated (NE). Reconstructive coverage is derived using RC = (F + 0.5P)/(F + P + N), with NE excluded.