Data - Clouds

You can directly integrate Cloud Forensic with MOBILedit Forensic Pro. With this option, you can extract data from clouds via a mobile device connected to MOBILedit Forensic Pro. The credentials are extracted from the device, and cloud extraction is started as part of the phone examination process. These credentials are also saved so that an investigator can either use the token or the account login details at a later date.

To be able to use this feature, it is necessary to have a computer connected to the internet.

Data from Clouds is copied to the computer, if the cloud contains 2TB of data, for example, then the user needs to make sure that they have enough free disk space on the computer. Therefore we advise you to use local filters to select what data you are interested in extracting.

Tokens are only valid for a limited period of time.

Cloud extraction starts as part of the phone examination process when Clouds are selected

Requirements:

To utilize the cloud module, you will need to have at least one of the following :

The sign-in credentials for the cloud service (user name & password)
Have a rooted Android
To know the iTunes backup password for iOS devices

The ways to extract data from Clouds:

Directly enter the sign-in credentials by using the username and password for the selected cloud.
Use the extraction option directly from a connected mobile device, backup, or physical image via a “Specific selection” Logical extraction.
Import the cloud credentials file extracted from a device. This is stored as the file “cloud_credentials.json” and located in the folder where extractions are set to save. For example, C:\Users\username\Documents\MOBILedit Forensic\Name of the phone (date and time). Multiple clouds can be selected for extraction this way.

1. Extraction using a mobile device

Connect the device, select Logical extraction, and in Specific selection select Clouds.

Users can select either to only extract the credentials (Tokens) by selecting “Clouds” and then analyzing them later, or by generating reports right away and selecting “Generate all” or “Generate selected clouds report”. Credentials (Tokens) are also stored in MOBILedit Backups and can be imported this way as well.

Each Cloud extraction generates a separate report in a dedicated folder. Users can select the location where the cloud data will be downloaded as either “next to report”, or “custom location”.

For other steps please follow the instructions in Cloud Forensic standalone product

Which clouds are supported and other information can be found MOBILedit Cloud Forensic