Detection and extraction of digital footprints from the iDrive cloud storage using web browser forensics analysis

Abstract

STorage as a service (STaaS) allows its subscribers the ability to access their stored data with the use of internet enabled digital devices at anywhere, anyplace and anytime. The easy accessibility of cloud storage with digital devices is one of the major benefits of cloud computing but this benefit can also be exploited by cybercriminals to perform various forms of malicious usages. During forensic investigation, forensic examiners are expected to provided evidence in relation to the malicious usages but the physical inaccessibility to the digital artifacts on the cloud servers, the difficulty in retrieving evidential artifacts from various cloud storage services and the difficulty in obtaining forensic logs from the concerned cloud service providers among other factors make it difficult to perform forensic investigations. This paper provided step by step experimental guidelines to extract digital artifacts from Google Chrome and Internet Explorer from Windows 10 personal computer using iDrive cloud storage as a case study. The study used Nirsoft forensic tool to locate the relevant forensic artifacts and an integrated conceptual digital forensic framework was adopted to carry out the investigation. This study increases the knowledge of client forensics using web browser analysis during cloud storage forensic investigation.