kbc@keithborer.co.uk +44 (0)191 332 4999
Home Services Our Team News FAQ CPD & Training Vacancies

Digital Forensics Cloud Data

Cloud Data

In today’s digital world, where vast amounts of our private and public information are stored across numerous online platforms, the need for comprehensive forensic analysis of digital accounts in legal proceedings has never been more apparent.

Traditional digital forensics focuses on analysis of physical devices, such as a phone or computer. Whilst data associated with online platforms like Facebook, Instagram, Google etc may be stored on a digital device such as a mobile phone, this can often be just a subset of the information available on the account, as the data is stored in the ‘cloud’ rather than on the device itself. A more complete version of this data may be obtained by examining the relevant account on that online platform instead of, or in conjunction with, an examination of the device.

What is the ‘Cloud’?

The Cloud refers to servers that are accessed over the Internet, rather than a device physically in your possession. Data is stored in the Cloud so that it can be accessed from any device. For example, if you get a new phone, you can simply log in to your account and all your data is there ready for you.

But why is it called the Cloud? It started off as a nickname for the Internet; in the early days, technical diagrams often represented the servers that make up the Internet as clouds, and so the term was born!

Tailored forensic examinations at Keith Borer Consultants

We specialise in providing expert forensic services tailored to examining digital accounts and other sources of cloud-stored data. We can advise on how best to approach capturing the data you need and liaise directly with your client to address the increasingly complex security controls that protect online services.

Casework examples

An examination of a digital account can provide an unparalleled insight into past events. Cases we’ve worked on include:

  • Recovering large amounts of Instagram communications between two users which were not recoverable from the seized digital device.
  • Advising on the possibility of unauthorised access to a Facebook account at the time messages of interest were sent, by analysing IP address information and other authentication data stored within the account.
  • Recovering communications and photos that were no longer stored on an Apple iPhone but were stored within a backup automatically created on the iCloud service.
  • Identifying the movements of a mobile phone by analysing Google Maps data stored within a Google account.
  • Analysis of a Snapchat account to establish when it was created, and when details such as the display name had been updated. This allowed comparisons to screenshots produced as evidence to rule out the Snapchat account from being the account shown.

It is not only about the data stored in the cloud, it is equally important to understand how these services work. We are regularly instructed to perform functionality testing to explain how a service works, or whether a particular version of events is plausible given the limitations of the platform.

Get in touch

If you have a case that you believe may involve an online platform or application, please contact our Durham office on 0191 332 4999 or email kbc@keithborer.co.uk.