Page 1

CLOUDEXFILTRATION · A GUIDE FOR UK LAWYERS Data Exfiltration to Cloud Storage Tracing Company Data Uploaded to Personal and Third-Party Clouds COMPUTER FORENSICS LAB

§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM ESTABLISHED 2007 · LONDON ISO 17025-ALIGNED PROCEDURES CLOUD-EXFILTRATION INVESTIGATION SYNC-CLIENT & EGRESS ANALYSIS CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION

§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the network copy that writes to both ends 03 The routes: sync clients, browser uploads, sharing, webmail and rules 04 The end point record: sync databases, browser artefacts and local traces 05 The platform and network record: audit logs, sharing events and egress 06 The destination: reaching the personal cloud account through process 07 Quantification, deployment and the innocent explanation 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist

§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: CLOUDEXFILTRATIONWRITESTOTHEENDPOINT, THE CORPORATE PLATFORM, THENETWORKANDTHEDESTINATIONACCOUNT: PROVEWHAT LEFTFROMTHEFIRSTTHREE, REACHWHEREITWENTTHROUGHTHEFOURTH, AND QUANTIFYTOAFILE - LEVELMANIFEST

§ 02 · FIRST PRINCIPLES The problem in plain English: the network copy that writes to both ends

§ 03 · THEROUTES The routes: sync clients, browser uploads, sharing, webmail and rules