Skip to main content
SpringerLink
Log in

Cloud evidence tracks of storage service linking with iOS systems

  • Published:
The Journal of Supercomputing Aims and scope Submit manuscript

Abstract

The increasing usage of mobile cloud computing leads the cloud to become a hotbed of crime. Cloud storage is different from previous data storage in digital forensics. In this paper, we concentrate on gathering evidence from mobile iOS devices and the types of data remnants that can be found on iOS devices for different user scenarios and device states. We develop several steps for experimenting on Google Drive, OneDrive and Dropbox. We found that the evidence collection of power-off state is not the major problem in digital forensics. Different applications of cloud storage show the different statuses of data remnants. The study also shows that thumbnails and cache files are the key of evidence recovery. We present how the digital investigators to collect evidence by examining the data remnants files as well.

This is a preview of subscription content, log in via an institution to check access.

Access this article

Log in via an institution

Price excludes VAT (USA)
Tax calculation will be finalised during checkout.

Instant access to the full article PDF.

Institutional subscriptions

Fig. 1
Fig. 2
Fig. 3
Fig. 4
Fig. 5
Fig. 6
Fig. 7
Fig. 8
Fig. 9

Similar content being viewed by others

References

  1. IDC (2020) Retrieved from https://www.idc.com/promo/smartphone-market-share/os. Accessed 3 Feb 2020

  2. Dinh HT, Lee C, Niyato D, Wang P (2013) A survey of mobile cloud computing: architecture, applications, and approaches. Wirel Commun Mob Comput 13(8):1587–1611

    Article  Google Scholar 

  3. NIST Special Publication 800-101 (2014) Guidelines on cell phone forensics

  4. Brothers S (2009) Cell phone and GPS forensic tool classification system. In: Presentation to Digital Forensics

  5. Ruan K, Carthy J, Kechadi T, Baggili I (2013) Cloud forensics definitions and critical criteria for cloud forensic capability: an overview of survey results. Digit Investig 10(1):34–43

    Article  Google Scholar 

  6. Guo H, Jing B (2012) Forensic investigations in Cloud environments. In: International Conference on Computer Science and Information Processing (CSIP), pp 248–251

  7. Dezfouli F, Dehghantanha A, Mahmoud R, Sani N, Shamsuddin S (2012) Volatile memory acquisition using backup for forensic investigation. In: International Conference on Cyber Security, Cyber Warfare and Digital Forensic

  8. Quick D, Choo K (2013) Forensic collection of cloud storage data: Does the act of collection result in changes to the data or its metadata? Digit Investig 10(3):266–277

    Article  Google Scholar 

  9. Poore J, Flores J, Atkison T (2013) Evolution of digital forensics in virtualization by using virtual machine introspection. In: ACM Southeast Conference

  10. Marty R (2011) Cloud application logging for forensics. In: ACM Symposium on Applied Computing, pp 178–184

  11. Chung H, Park J, Lee S, Kang C (2012) Digital forensic investigation of cloud storage services. J Digit Investig 9:81–95

    Article  Google Scholar 

  12. Liao Z, Wu S, Xi B, Wang F, Ming D, Chen B (2019) Digital forensics design of IOS operating system. In: Proceedings of the 2019 3rd High Performance Computing and Cluster Technologies Conference (HPCCT 2019), pp 232–236

  13. iTunes (2020) Retrieved from https://support.apple.com/zh-tw/itunes. Accessed 3 Feb 2020

  14. Grispos G, Glisson WB, Storer T (2013) Using smartphones as a proxy for forensic evidence contained in cloud storage services. In: 46th Hawaii International Conference in System Sciences (HICSS), pp 4910–4919

  15. Fernando N, Loke SW, Rahayu W (2013) Mobile cloud computing: a survey. Future Gener Comput Syst 29:84–106

    Article  Google Scholar 

  16. Google Drive (2020) Retrieved from https://www.google.com/drive/. Accessed 3 Feb 2020

  17. OneDrive (2020) Retrieved from https://support.office.com/zh-tw/onedrive. Accessed 3 Feb 2020

  18. Dropbox (2020) Retrieved from https://www.dropbox.com/help/security. Accessed 3 Feb 2020

  19. iTools (2020) Retrieved from http://pro.itools.cn/itools3/feature.php. Accessed 3 Feb 2020

  20. Bader M, Baggili I (2010) iPhone 3GS forensics: logical analysis using Apple iTunes backup utility. Small Scale Digit Device Forensics J 4(1):1–15

    Google Scholar 

Download references

Acknowledgement

This research was partially supported by the Oriental Institute of Technology under the Grants RD 108-7-11-006, RD 108-0055 and the Ministry of Science and Technology of the Republic of China under the Grants MOST 107-2221-E-005-031 and MOST 107-2221-E-015-001-MY2.

Author information

Authors and Affiliations

  1. Department of Computer Science and Engineering, National Chung-Hsing University, Taichung, Taiwan

    Hung-Jui Ko & Gwoboa Horng

  2. Department of Information Management, Oriental Institute of Technology, New Taipei City, Taiwan

    Cheng-Ta Huang

  3. Department of Information Management, Central Police University, Taoyüan, Taiwan

    Zhi-Wei Zhuang & Shiuh-Jeng Wang

Authors
  1. Hung-Jui Ko
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Cheng-Ta Huang
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Zhi-Wei Zhuang
    View author publications

    You can also search for this author in PubMed Google Scholar

  4. Gwoboa Horng
    View author publications

    You can also search for this author in PubMed Google Scholar

  5. Shiuh-Jeng Wang
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Shiuh-Jeng Wang.

Additional information

Publisher's Note

Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.

Rights and permissions

Reprints and permissions

About this article

Check for updates. Verify currency and authenticity via CrossMark

Cite this article

Ko, HJ., Huang, CT., Zhuang, ZW. et al. Cloud evidence tracks of storage service linking with iOS systems. J Supercomput 77, 77–94 (2021). https://doi.org/10.1007/s11227-020-03255-5

Download citation

  • Published:

  • Issue Date:

  • DOI: https://doi.org/10.1007/s11227-020-03255-5

Keywords

Search

Navigation