Forensicating Endpoint Artifacts in Cloud Storage Services
Renzon Cruz investigates host forensic artifacts left by cloud sync clients (OneDrive, Google Drive, Dropbox), tracing insider data exfiltration.
Summary
Cloud Storage Sync Clients as an Investigation Frontier
Modern enterprise endpoints integrate desktop sync clients for OneDrive, Google Drive, Box, and Dropbox, which are frequently leveraged by insiders and adversaries for data exfiltration.
Extracting Local Cloud Client Forensic Artifacts
Renzon Cruz details forensic extraction techniques for local sync SQLite databases, sync log files, shellbags, and cache directories across Windows and macOS.
Reconstructing File Deletion and Upload Timelines
Cruz demonstrates parsing local sync telemetry to determine exact file modification timestamps, uploaded file paths, user account associations, and sync status.
DFIR Triage Workflows for Cloud Storage Intrusions
The presentation provides investigators with open-source parsers and investigative checklists to rapidly quantify exfiltrated data volumes.
Related talks
Blue Team Village·52 min
John Bambenek
John Bambenek recounts pro bono digital forensics casework, exposing flawed prosecution expert testimony and emphasizing sound forensic methodologies.
S4 Events·37 min
Industry experts analyze emerging threats surrounding Digital Forensics and Incident Response (DFIR) for ICS Embedded Devices.
CREST Videos·13 min
Working in DFIR
Working in DFIR | David Gray (Director, Global Digital Forensics and Incident Response Lead, NTT).