Digital droplets: Microsoft SkyDrive forensic data remnants

Cloud storage services such as the popular Microsoft© SkyDrive© provide both organisational and individual users a cost-effective, and in some cases free, way of accessing, storing and disseminating data. The identification of digital evidence relating to cloud storage services can, however, be a challenge in a digital forensic investigation. Using SkyDrive as a case study, we identified the types of terrestrial artefacts that are likely to remain on a client’s machine (in the context of our experiments; computer hard drive and iPhone), and where the access point(s) for digital forensics examiners are, that will allow them to undertake steps to secure evidence in a timely fashion.

► Digital evidence can be stored in cloud storage services, such as SkyDrive.
► Identification of potential data storage is a challenge to forensic examiners.
► SkyDrive was examined in relation to data remnants on a PC and an iPhone.
► SkyDrive passwords can in some instances be located as plain text in memory.
► Investigation points include: directory listings, prefetch, link, and registry.