Conducting a forensic investigation of Amazon Drive on Android devices

Abstract

In the last few years, Cloud Storage has taken a new turn in becoming the latest trend to create a huge impact in the IT world. Amazon Drive is a cloud storage mobile applications created by Amazon. This application provides online and easy access to documents, music, photos and videos saved in your cloud drive. Due to the importance and widespread of the cloud, not only regular users, but also criminals have taken advantage of the services provided by this new technology to commit digital crimes. Digital forensics is a branch of forensic sciences that aims at investigating digital evidence found on electronic devices to help combat cybercrimes. It aims at identifying, preserving. collecting, analyzing and reporting digital remnants. Digital forensics plays a key role in helping forensic investigators identify valuable and court admissible information. In this thesis, an analysis is performed on the digital artifacts that are left behind on an Android device after Amazon Drive have been accessed. Methods and tools were used to examine digital evidence, its importance and relevance, to allow examiners to secure the evidence properly. This thesis follows 31 four step digital forensic framework to follow a proper forensic investigation process. The results of this process has identified the location of the evidence related to the Amazon Drive account. In addition, the tiles and folders were identified and in some cases the content of some tiles was retrieved. This thesis showed that deleted files can also be acquired.