Information is constantly at our fingertips, and our data may no longer be physically within the four walls of an office. With billions of users using cloud storage, it is important to discuss the value of this data source from an evidentiary and investigative standpoint.

There are benefits to storing data with cloud storage services. For example, cloud storage allows a user to free up storage on local devices, share large files and access data from multiple devices. Many cloud storage services offer limited storage at no cost, but upgrading to a paid subscription may allow for more storage and advanced features for account management. When data is uploaded to a cloud storage service, the data is stored on servers at data centers around the world. The data is accessible via an app, a website or a software program. Files and folders can be uploaded, organized and shared with others.

|

Is It All Business or Some Personal?

Many organizations have shifted from on-premise storage to cloud storage. Administrators can manage user accounts remotely. Based on their subscription model, advanced features may allow colleagues to collaborate and integrate the cloud solution with other solutions. Additionally, administrators may be able to track user activity, file usage and recover deleted data based on retention policies.

Cloud storage allows users to have access to their data on the go. Depending on security policies and bring-your-own-device (BYOD) policies more prevalent, an organization may not restrict access to cloud storage services. As a result, it may be possible for employees to upload data to their personal accounts. It has become important to interview the legal team and IT administrators of an organization to understand the policies that may be in place.

Additionally, it has become important to interview an employee to understand where they may save data and ask if they store data with cloud storage services. If the account is personal, it is likely that it will need to be accessed, so that the data can be identified and collected, if necessary. The employee will need to provide their account credentials and assist if multifactor authentication is enabled. With a personal account, there may be sensitivity regarding other data that may be present in the account. It will be important to explain how non-relevant data will be addressed.

Data from cloud storage may reside within the account but it may be viewed, stored and synced on local devices. It is important to understand where the relevant data is stored, if there are older or current versions of the data and how it must be collected. Hopefully, the employee will assist; if not, often, recent devices connected or linked may be recorded within the account. Additionally, it may be possible to perform keyword searches to identify relevant data within the cloud storage service. However, there may be limitations as to what data is included in the keyword searches based on the data's format and whether the data was indexed.

|

Forensic Preservation: Software Tools and Methodologies

Forensic vendors have responded to the need to perform defensible, data collections from cloud storage services. Forensic preservation involves performing a data collection, whereas the integrity of the source data, including metadata, is maintained throughout the process.

There are software tools available; however, not every tool supports every cloud storage service. We find that uploading data may be easy but exporting data, specifically for eDiscovery purposes, may be more complex. As technology is constantly changing, forensic vendors are constantly trying to keep up. Data collection specialists must, therefore, confirm compatibility of software tools with the targeted cloud storage service. Compatibility is not always guaranteed, as often, these software tools interact with the application programming interface (API) for the cloud storage services which may change at any time. Data collection specialists must therefore maintain licenses for several software tools, for compatibility and to validate data collections. Further, it is important for data collection specialists to collaborate with forensic vendors and to obtain technical support, as needed.

Although the forensic vendors work diligently to update the software tools, if the cloud storage service is unsupported by the software tools, a data collection specialist may need to utilize or develop methodologies to perform the required data collection. It may be necessary for the data collection specialist to work directly with the administrator at an organization, responsible for the cloud storage, or technical support at the cloud storage service.

|

Enjoy the Time on Cloud 9

Performing the data collection will take time and depends on several factors, including: Internet bandwidth available to the data collection specialist and the volume of data to be collected. Often, cloud storage services throttle downloads, limiting how much data can be exported at a given time. It is important to keep communication flowing between all parties, so that there is clarity on how long the process may take, how the accessibility of the account may be impacted and any known deadlines.

Data is now everywhere, and the way we interact with data is changing every day. Now, more than ever, it is important to ask questions of stakeholders and experts to understand where relevant data may reside. Questions to raise, include:

  • What cloud storage services are being utilized?
  • Is data comingled or organized?
  • What is the anticipated storage volume of data within the account?
  • Will access be provided by the IT administrator or data custodian?
  • Does my forensic expert have software tools or methodologies that support the data collection?
|

Robert B. Fried is a senior director for Consilio's Digital Forensics & Expert Services practice, where he manages, investigates, and performs digital evidence collections and examinations. Robert joined Consilio through its acquisition of Huron Legal in 2016. Prior to joining Huron Legal, Robert was a Consultant at DOAR Litigation Consulting where he provided digital evidence consulting to the firm's clients in support of litigation discovery and investigative matters.