Forensic investigation of OneDrive, Box,
GoogleDrive and Dropbox applications on Android
and iOS devices

Daryabar, F; Dehghantanha, A; Eterovic-Soric, B; Choo, KR

Abstract

In today’s Internet-connected world, mobile devices are increasingly used to access
cloud storage services, which allow users to access data anywhere, anytime. Mobile
devices have, however, been known to be used and/or targeted by cyber criminals
to conduct malicious activities, such as data exfiltration, malware, identity theft,
piracy, illegal trading, sexual harassment, cyber stalking and cyber terrorism. Consequently, mobile devices are an increasing important source of evidence in digital
investigations. In this paper, we examine four popular cloud client apps, namely
OneDrive, Box, GoogleDrive, and Dropbox, on both Android and iOS platforms
(two of the most popular mobile operating systems). We identify artefacts of forensic interest, such as information generated during login, uploading, downloading,
deletion, and the sharing of files. These findings may assist forensic examiners and
practitioners in real-world examination of cloud client applications on Android and
iOS platforms.

Citation

and iOS devices. Australian Journal of Forensic Sciences, 48(6), 615-642. https://doi.org/10.1080/00450618.2015.1110620

• Journal Article Type: Article
• Acceptance Date: Aug 17, 2015
• Publication Date: Mar 3, 2016
• Deposit Date: Mar 7, 2016
• Journal: Australian Journal of Forensic Sciences
• Print ISSN: 0045-0618
• Electronic ISSN: 1834-562X
• Publisher: Taylor and Francis
• Volume: 48
• Issue: 6
• Pages: 615-642
• DOI: https://doi.org/10.1080/00450618.2015.1110620
• Publisher URL: http://dx.doi.org/10.1080/00450618.2015.1110620
• Related Public URLs: http://www.tandfonline.com/toc/tajf20/current