Beware Smartphone Lurkers: Cloud Storage File Remnants

Security investigators recovered Box, Dropbox and SugarSync files and unique file IDs, via forensic dump of iPhone and Android smartphone memory.

9 More Cloud Computing Pioneers (click image for slideshow)
Cloud storage service apps leave recoverable traces of files on smartphones.
That finding comes from recently published
research
, Using Smartphones as a Proxy for Forensic Evidence contained in Cloud Storage Services, conducted by University of Glasgow computer science PhD student George Grispos -- backed by computer forensics and e-discovery lecturer Brad Glisson and software engineering lecturer Tim Storer, both also of University of Glasgow -- which was presented at this years 46th Hawaii International Conference on System Sciences.
The researchers said theyd expected to find that smartphone devices will retain data from these storage services, but didnt know to what extent any leftover artifacts might include recoverable information. So they studied three popular cloud storage service apps running on the iPhone and on an HTC Desire running the Android operating system.
Heres what they found: Using mobile forensic toolkits, data can be recovered from a smartphone device which has accessed a cloud storage service, they said. The results from the experiment have shown that it is possible to recover files from the Dropbox, Box and SugarSync services using smartphone devices. In addition, artifacts left by those services mobile apps in some cases allowed the researchers to gain a proxy view of files not stored on the device, but stored by the cloud service.
[ Companies have to protect their assets, but where do they cross the line into overzealous prying? See
Monitoring Vs. Spying: Are Employers Going Too Far?
]
The extent to which they could recover files varied based on the operating system studied. On the HTC Desire, both deleted and available files were recovered. The forensic toolkits recovered 9 files from Dropbox, 15 from Box and 11 from SugarSync, the researchers said. On the iPhone, depending on application and device manipulation either 5 or 7 files were recovered from Dropbox, 7 or 15 from SugarSync and 5 from Box. No deleted application files were recovered from the iPhone.
Interestingly, the investigators could also use the Box apps file artifacts that they recovered to access copies of files that were no longer stored on devices, but still stored with Box. This required recovering file IDs for Box files that had been accessed, as well as authentication tokens linked to a specific Box users account. With both pieces of information, the researchers could create a URL which accessed the Box API to download copies of files not present on the device, all without logging into the service. This digital forensic investigation technique worked on both the iPhone and Android devices.
Just to be clear, the researchers confined their study to these -- now superseded -- smartphone apps: Dropbox (iOS version 1.4.7, Android version 2.1.3), Box (iOS version 2.7.1, Android version 1.6.7) and SugarSync (iOS version 3.0, Android version 3.6).
What can smartphone users do to obscure any cloud-based files theyve viewed? According to the researchers, clearing the cache led to them recovering fewer Dropbox and SugarSync files, but had no effect on the Box files. The researchers also reported that their file recovery success on the Android device depended, predictably, on whether the file had been saved for offline use, and if so, whether or not it had been saved to an external memory card, then deleted and overwritten, at which point it was unrecoverable. What are the implications of these findings? As more people use smartphones, digital forensic investigators -- including police departments and law enforcement agencies -- are increasingly looking at such devices to recover usable evidence. Last year, for example, police in London announced that they were
testing mobile phone data extraction devices
to allow specialist teams to access, study and save any data stored on a suspects mobile device. In the future, however, they may need to study not one device, but many, given the extent to which many people now own multiple devices.
On that front, the Glasgow researchers said theyre now continuing their study to cross-reference forensic examinations of multiple devices used by the same person. The very nature of the cloud environment encourages users to access data through multiple devices, they said, noting that they already have an experiment underway to access residual artifacts from Gmail, Mozy, Ubuntu One and Evernote on end devices connected to these services. Their question is whether conducting a forensic analysis of multiple devices used by the same user will yield a greater number of recoverable files and artifacts.
The first step was to say, is this an idea thats going to work, then we can say, in future research, how do we use this data to say something useful for a forensic investigator, in terms of merging evidence from different proxies into a single data set? said paper co-author
Tim Storer
, speaking by phone. For example, if part of an Excel spreadsheet is found on one device, but not another two devices used by the same user, should it count as evidence? Theres often a tendency by forensic investigators to conflate data and evidence, he said, when a higher threshold is called for.
Going forward, the researchers said in their paper that they hope to detail the data leakage risk that cloud applications introduce to corporate environments in greater detail, as well as to propose a set of security measures for both cloud providers and smartphone users to mitigate the potential risk of data leakage.
These services are being used in corporate environments more and more ... so its a potential source of risk for an organization, said Storer. Sensitive documents may end up on someones device thats subject to analysis. But businesses might minimize those types of risks by steering their employees to use devices from which its more difficult to recover usable information, forensically speaking. Likewise, cloud service providers could offer their corporate customers specialized services that scrubbed all data stored by their mobile apps, once a user no longer needed to view it.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Beware Smartphone Lurkers: Cloud Storage File Remnants