Introducing Cloud Forensic Capabilities
/More and more of our data is moving to the cloud. From photo storage on Google, Apple, or Amazon, to entire offices moving to Microsoft with Office 365 – the cloud has become a wealth of information for digital investigations. This is why Chase Technology Consulting now has the capability to download and examine cloud data in a forensically safe manner.
To do this, we obtain the login information from the user, or the cloud access tokens from the user’s phone, to directly connect to the cloud provider. Using the login credentials, we use a tool to access the cloud data directly and download it. The data is put directly into a digital forensic program where it is stored in a forensically sound manner, as well as sorted and categorized for later production in litigation.
Adding cloud data to an investigation gives us the ability to do far more than merely report on data stored with a cloud storage provider. With cloud data, we can draw connections between local data and how that data may have been saved, shared, or exported through use of cloud providers.
Imagine an intellectual property theft case. We can examine the computer the suspect used. By looking at the computer, we may be able to see how a file moved on the system, see if it was modified, and see if it was moved off to a USB drive. By adding cloud data, we can see if that file was uploaded to a cloud storage for later off-site access. We may be able to see if that file was emailed, who it was emailed to, and if it was shared with other people online.
The addition of cloud forensics will allow us to paint a much more detailed picture of what users did. Contact us today to find out how cloud forensics can help your next case.