Dropbox analysis: Data remnants on user machines

Cloud storage has been identified as an emerging challenge to digital forensic researchers and practitioners in a range of literature. There are various types of cloud storage services with each type having a potentially different use in criminal activity. One area of difficulty is the identification, acquisition, and preservation of evidential data when disparate services can be utilised by criminals. Not knowing if a cloud service is being used, or which cloud service, can potentially impede an investigation. It would take additional time to contact all service providers to determine if data is being stored within their cloud service. Using Dropbox™ as a case study, research was undertaken to determine the data remnants on a Windows 7 computer and an Apple iPhone 3G when a user undertakes a variety of methods to store, upload, and access data in the cloud. By determining the data remnants on client devices, we contribute to a better understanding of the types of terrestrial artifacts that are likely to remain for digital forensics practitioners and examiners. Potential information sources identified during the research include client software files, prefetch files, link files, network traffic capture, and memory captures, with many data remnants available subsequent to the use of Dropbox by a user.