Authors: Christopher Hargreaves, Angus Marshall
DFRWS EU 2019
Abstract
While the number and variety of devices can be problematic in a digital investigation, this is also a problem for consumers. As a result, software developers are implementing synchronisation features to assist customers handle the multitude of devices that they now use. This paper describes how these synchronisation features can be exploited as part of a digital investigation to use the results from the examination of one device to infer content of other devices. This extracted information is potentially useful in determining the devices that should have the most resources expended during an investigation to obtain the most actionable evidence in the quickest and most efficient manner.