Forensic Evidence From Dropbox Box And ShareFile

FILE - SHARINGPLATFORMS · AGUIDEFORUKLAWYERS Forensic Evidence from Dropbox, Box and ShareFile Sync Artefacts, Activity Logs and Sharing Trails on the Independent File Platforms COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM ESTABLISHED 2007 · LONDON ISO 17025-ALIGNED PROCEDURES FILE-PLATFORM COLLECTION SYNC-CLIENT ARTEFACT ANALYSIS CPR PART 35 EXPERT REPORTS FULL CHAIN-OF-CUSTODY DOCUMENTATION § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the third file platform nobody mapped 03 The platform record: version histories, activity logs and sharing trails 04 The desktop clients: local sync databases and machine artefacts 05 Sharing, links and external collaboration: who reached the data 06 Preservation and collection: admin export, API and legal process 07 Deployment: disclosure, exfiltration and the account nobody admits to 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary THEHEADLINEPOINT : DROPBOX , BOXANDSHAREFILEEACHKEEPAPLATFORM - SIDE EVERYMACHINE : COLLECTBOTH , BECAUSETHEPLATFORMPROVESWHATHAPPENED ANDTHECLIENTCORROBORATESITWHERETHEACCOUNTISDENIEDORGONE § 0 2 · FIRSTPRINCIPLES The problem in plain English: the third file platform nobody mapped § 0 3 · THEPLATFORMRECORD The platform record: version histories, activity logs and sharing trails § 0 4 · THEDESKTOPCLIENTS The desktop clients: local sync databases and machine artefacts § 0 5 · SHARING , LINKSANDEXTERNALCOLLABORATION Sharing, links and external collaboration: who reached the data § 0 6 · PRESERVATIONANDCOLLECTION Preservation and collection: admin export, API and legal process § 0 7 · DEPLOYMENT Deployment: disclosure, exfiltration and the account nobody admits to § 0 8 · THEWIDERMAP Source architecture: where else the evidence lives QUESTION CLIENT (PROXY/ PLATFORM LOG + COLLABORATORS PROVIDER BEHAVIOURAL + VERSION + COUNTERPARTS RECORDS EXPENSE LAYER HISTORY DESKTOP- NETWORK DATABASE CASB) § 0 9 · INTHEWILD Worked examples EXAMPLE1 · THEDEALROOMANDTHECOLLABORATORWHOLINGERED EXAMPLE2 · THEACCOUNTNOBODYPUTINTHEDATAMAP EXAMPLE3 · THESHAREFILEPORTALANDTHESANCTIONEDSHARE § 1 0 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 1 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your eDiscovery / forensic provider § 1 2 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The file-platform checklist Red flags When to involve a digital forensic expert § 1 3 · COMMONQUESTIONS Frequently asked questions Do Dropbox, Box and ShareFile keep the kind of logs we need? The account has been deleted. Is the evidence gone? Someone shared a folder externally. How do we find out who reached it? We found a Dropbox client on a laptop but nobody admits to the account. What now? The other side accuses us of leaking through our sharing platform. How do we answer? How is this different from OneDrive or Google Drive? § 1 4 · REFERENCE Glossary Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY