How many of these scenarios have you encountered as an investigator?
- The suspect used an app for which there is no mobile forensic support. You could manually carve and decode the data from a physical extraction—assuming it is supported by the mobile forensics tools you use—but you lack time, and/or the forensic lab tells you it will be weeks before they can get the data back to you.
- You serve a search warrant on a cloud data provider, but they ignore your request, and/or they inform the suspect that you’re investigating.
- The cloud provider is willing to work with you, but they tell you they can’t comply with your search warrant or court order unless it is submitted a certain way. During the weeks it takes you to negotiate and get new paper signed, your victims recant their statement, and your witnesses are much less forthcoming in follow-up interviews.
A case that stalls or halts altogether, while you wait for time-sensitive webmail and/or social media data, means it’s a lot less likely that you’ll be able to find and apprehend a criminal. You need a way to obtain cloud-based evidence much more quickly, and preferably within the first few hours or days of a victim’s initial statement.
Obtaining private cloud data offers additional context for what was going on in a victim’s or suspect’s life during specific timelines. Having this context enables investigators to make informed decisions about how to proceed with a case, how to plan an interview strategy, and which individuals to focus on.
Restricting a search to these timelines, and to certain content types, not only reduces the amount of data you have to go through; it also protects individual privacy by eliminating the content that has nothing to do with the investigation.
Private cloud data access can also help to reduce the risk that you’ll have missed important artifacts from mobile devices and hard drives, especially when devices or apps are partially supported or unsupported for extraction.
Finally, faster access to important evidence reduces the risk of losing witnesses who lose interest before a provider returns data, or because a provider was resistant to being served or tried to inform the suspect. It can also help to identify victims who might not have come forward on their own.
With the proper legal authority, private cloud data can give you the data you need to make a case without adding too much irrelevant data to have to sift through. Download our solution brief now to learn more about how to leverage this capability within the UFED PRO Series as part of your investigations.