Forensic analysis of Sync.com and FlipDrive cloud applications on Android platform

Wasim Ahmad Bhat; Mohammad Faid Jalal; Sajid Sajad Khan; Faiqah Farooq Shah; Mohamad Ahtisham Wani

doi:10.1016/j.forsciint.2019.06.003

Forensic analysis of Sync.com and FlipDrive cloud applications on Android platform

Forensic Sci Int. 2019 Sep:302:109845. doi: 10.1016/j.forsciint.2019.06.003. Epub 2019 Jun 12.

Authors

Wasim Ahmad Bhat¹, Mohammad Faid Jalal¹, Sajid Sajad Khan¹, Faiqah Farooq Shah¹, Mohamad Ahtisham Wani¹

Affiliation

¹ Department of Computer Sciences, University of Kashmir, India.

PMID: 31248622
DOI: 10.1016/j.forsciint.2019.06.003

Abstract

The complex architecture and legal restrictions associated with cloud services make the acquisition of data from servers almost impossible in digital investigations involving cloud services. However, smartphones used to access these cloud services can serve as potential sources. In this paper, we investigate Sync.com and FlipDrive cloud client applications on Android platform for artefacts left behind by user activities. Our experiments demonstrate that rich information arising from user activities is left behind by these applications. This information includes installation details, login credentials, names and timestamps of files uploaded, downloaded, deleted and shared. The study also identifies mechanisms for extracting these artefacts from the devices. These findings assist forensic investigators in performing complete, credible and conclusive digital investigation by allowing them to create complete file management history of these applications. Finally, based on these findings, we make many recommendations relevant to the digital investigation involving these applications.

Keywords: Cloud storage; Digital investigation; File operations; Mobile applications; Smartphones.