Abstract
Proceedings of 2016 14th Annual Conference on Privacy, Security and Trust (PST) in Auckland, New Zealand, 12-14 Dec. 2016. Forensic examinations of a mobile phone that consider only the internal memory can miss potentially vital data that is accessible from the device, but not stored locally. In this paper, we look at a forensic tool that is able to download data stored on the cloud, using credentials gleaned from device extractions. Through experimention with a variety of devices and configurations, we examine the effectiveness of the software for its stated purpose. The results suggest that we are able to obtain information from the cloud in this manner, but only under some relatively strong assumptions. Practical issues and legal considerations are discussed.,Conference paper,Published.