Mobile, Cloud, and Emerging Technology Forensics
What this domain tests
This domain tests whether you can adapt acquisition and interpretation to devices and services where you rarely hold the original media: phones, cloud tenants, containers, and connected devices.
Core rules and concepts
- Mobile acquisition levels. Full file system, logical, and backup-based extraction differ in completeness. iOS offers jailbreak or advanced extraction for full access; Android offers ADB backup, physical images on rooted devices, and vendor extraction tools. State the level achieved and what it cannot contain.
- Mobile state. After First Unlock, more data is decrypted than Before First Unlock. Isolate radios with a Faraday bag or airplane mode; remote wipe is a real risk. Document any interaction with the screen or passcode.
- App artifacts. SQLite databases underpin most messaging and browser apps. Check for write-ahead log and shared-memory files, and recover deleted rows from freelists. Note UTC storage inside databases versus local display.
- Cloud model. The provider secures the infrastructure; the tenant secures data, identities, and configuration. Most content requires legal process: a warrant, a preservation request, or a mutual legal assistance treaty, with the CLOUD Act governing cross-border requests to US providers.
- Cloud audit sources. Microsoft 365 unified audit log, Google Workspace admin audit, and provider access logs record admin actions, sign-ins, sharing changes, and downloads.
- Emerging tech. Containers share a host kernel, so image the host as well as the container layer; IoT and vehicle systems hold proprietary artifacts; drones store flight logs.
Worked example
A photo is alleged to have been taken at a scene. EXIF creation time and GPS support capture, but the file could have arrived by messaging or cloud sync. Check the camera roll database for the asset identifier, the messaging database for the same hash, and cloud sync logs for upload time. Original capture is shown when the camera roll entry, EXIF, and absence of external transfer align.
Traps that cost marks
- Ignoring SQLite WAL files and missing the most recent records.
- Assuming a cloud provider will hand over content on request without legal process.
- Forgetting that mobile databases often store UTC while the interface shows local time.
- Reporting a backup extraction as a full file system image.
- Imaging a container without the host, losing network and runtime context.