Windows 8 cloud storage analysis: Dropbox forensics

Cloud-based services are becoming more prevalent for businesses along with home users who are benefiting from this opportunity by automating backups, making files available online, uploading files from any computer, sharing files and photos, and so on. Generally, limited cloud storage space is available free of cost and while extended storage can be purchased at reasonable price. Evidently, this leads to importance of cloud forensics. Cloud Forensics has two main parts, forensics at cloud based resources i.e. service provider´s end and forensics at Cloud user´s end. The cloud user´s end is generally of more interest and relevant in most of the forensic investigations as cloud based resources may be located in another geographical region considered as out of the influence of investigation team. The research work presented in this paper targets the cloud user´s end and aims at finding the data remnants of cloud storage activity, specifically Dropbox on Windows 8 platform. The results of this research include identification of forensic artifacts, identification of probable information sources and deduction of information from these.