Cloud Storage Forensics: Analysis of Data Remnants on SpiderOak, JustCloud, and pCloud
This work addresses the need for forensic investigators to handle cloud storage evidence, but it is incremental as it applies existing methods to new platforms.
The study analyzed data remnants on SpiderOak, JustCloud, and pCloud cloud storage platforms on Windows 8.1 and iOS 8.1.1 devices to track metadata changes and assess their forensic value, providing insights for evidence collection and analysis in cyber investigations.
STorage as a Service (STaaS) cloud platforms benefits such as getting access to data anywhere, anytime, on a wide range of devices made them very popular among businesses and individuals. As such forensics investigators are increasingly facing cases that involve investigation of STaaS platforms. Therefore, it is essential for cyber investigators to know how to collect, preserve, and analyse evidences of these platforms. In this paper, we describe investigation of three STaaS platforms namely SpiderOak, JustCloud, and pCloud on Windows 8.1 and iOS 8.1.1 devices. Moreover, possible changes on uploaded and downloaded files metadata on these platforms would be tracked and their forensics value would be investigated.