Abstract:There is a growing demand for cloud storage services such as Dropbox, Box, Syncplicity and SugarSync. These public cloud storage services can store gigabytes of corporate and personal data in remote data centres around the world, which can then be synchronized to multiple devices. This creates an environment which is potentially conducive to security incidents, data breaches and other malicious activities. The forensic investigation of public cloud environments presents a number of new challenges for the digital forensics community. However, it is anticipated that end-devices such as smartphones, will retain data from these cloud storage services. This research investigates how forensic tools that are currently available to practitioners can be used to provide a practical solution for the problems related to investigating cloud storage environments. The research contribution is threefold. First, the findings from this research support the idea that end-devices which have been used to access cloud storage services can be used to provide a partial view of the evidence stored in the cloud service. Second, the research provides a comparison of the number of files which can be recovered from different versions of cloud storage applications. In doing so, it also supports the idea that amalgamating the files recovered from more than one device can result in the recovery of a more complete dataset. Third, the chapter contributes to the documentation and evidentiary discussion of the artefacts created from specific cloud storage applications and different versions of these applications on iOS and Android smartphones.

ReLF: Scalable Remote Live Forensics for Android

Responding to Living-Off-the-Land Tactics using Just-in-Time Memory Forensics (JIT-MF) for Android

Malton: Towards On-Device Non-Invasive Mobile Malware Analysis for ART.

Recovering Residual Forensic Data from Smartphone Interactions with Cloud Storage Providers

Visible Forensic Investigation for Android Applications by Using Attack Scenario Reconstruction.

RiskRanker: scalable and accurate zero-day android malware detection.

Mobile Forensics: Repeatable and Non-Repeatable Technical Assessments

Analyzing Android Application in Real-Time at Kernel Level

Methodology for Forensics Data Reconstruction on Mobile Devices with Android Operating System Applying In-System Programming and Combination Firmware

A Visualization Approach to Analyze Android Smartphone Data

Enabling the Remote Acquisition of Digital Forensic Evidence through Secure Data Transmission and Verification

Digital Forensics Security Analysis on iOS Devices

Systematic Evaluation of Forensic Data Acquisition using Smartphone Local Backup

Mobile Phone Forensics: An Investigative Framework based on User Impulsivity and Secure Collaboration Errors

Mobile Cloud Forensics: An Analysis of Seven Popular Android Apps

Mobile3DRecon: Real-time Monocular 3D Reconstruction on a Mobile Phone

RealDroid: Large-Scale Evasive Malware Detection on "real Devices"

FLaaS: Cross-App On-device Federated Learning in Mobile Environments

Long Term Evolution Network Security and Real-Time Data Extraction

A forensic analysis of AnyDesk Remote Access application by using various forensic tools and techniques

A Tool for Volatile Memory Acquisition from Android Devices.