Data can be stored in multiple locations, whether it is an automatic backup created from an iPhone, or a user initiated manual backup to an external storage device. When it comes to electronically stored information (ESI) used in litigation, we often find case-relevant data in more than one location. Engaging a digital forensic expert can uncover potential data locations that might otherwise go unnoticed.
Based on my experience helping our clients recover ESI for their cases, these are the “hidden” locations we examine when the primary source is either unavailable, deleted, or inaccessible.
Many service providers offer a way to back up your data on the local drive of a PC/laptop, to a file server location, or to the cloud. Backups can be done through a service provider like Verizon, on their Verizon Cloud, or through a devices own application or software like Samsung’s Smart Switch or Apple’s iCloud. Each backup service has its own unique features and capabilities, backing up and storing data in various formats. Most services will allow you to specify which device data to backup. This data is typically overwritten or appended as subsequent backups are created.
In addition to backing up device data to cloud storage, Apple and Android devices offer the ability to create locally stored backups. Apple’s iTunes backup is widely recognized and can be easily done on a computer with iTunes. Android phones have several options for backing up data: one that is a completely manual process, and others that are done through automated applications like Smart Switch, or Google Backup that can allow you to select specific device data types for backup.
Exponential amounts of data are being moved to cloud storage every day. Cloud storage can be viewed as information accessed through the internet, rather than physically interacting with it in a local storage spot. Many services today offer cloud storage. Social media, email, and file sharing services are largely cloud-based, with a few exceptions.
With competitive pricing in the market for hosted storage, many users are choosing to store data in the cloud with various providers. Microsoft and Google offer many popular services for businesses. OneDrive, Dropbox, and Google Drive are popular forms of file storage and sharing. This data is accessed using a web browser or an application on your local computer or mobile device, allowing a user to create backups of these files locally on their machine. Typically, interactions with cloud storage providers are logged and made accessible, depending on the service you choose. It is important to make sure you are using the provider’s software version that best suits your needs.
For example, users generally access Gmail through a web browser. However, some users may have synced their Gmail account with a local email application on their device. With both configurations, the data is being hosted and stored on servers owned by Google.
Data can be backed up to local storage through several methods. There is a variety of software that allows you to back up data to a local workstation, server, or external media. Users could access this data without an internet connection, depending on how the local network is setup. Services like Time Machine for Apple are built for taking automated snapshots of your computer and storing them on external media.
It’s important to note that when external media is connected to a computer, it leaves behind a footprint, tracking the date and time it was connected. Files moved between a computer and an externally connected drive can leave behind evidence of the transfer. This evidence can be uncovered by digital forensic professionals.
We deal with many cases where the primary data set is unavailable for one reason or another. If the data is imperative to your case, it’s wise to engage a forensic investigator to help identify and collect data that may be hiding in other locations. During litigation, a digital forensic expert can also help show cause through an affidavit for preservation and inspection when the primary data set is compromised.
For more information on how a digital forensic expert can uncover data pertinent to your case, or to learn about LOGICFORCE’s comprehensive digital forensics offering, contact us.
Donnie Tennant is a Digital Forensics Investigator at LOGICFORCE. Donnie has been practicing digital forensics since 2016, with an emphasis on mobile devices and cloud forensics through specialized training from industry leaders in the mobile forensics community.