Cloud forensics
Notifications OFF
I really don't understand how this works for evidence. Is it downloaded on the day? Once the person is released surely their cloud data is always changing because of new emails/photos etc on a replacement phone. Or if they use their cloud for work etc
There is going to be a problem with anything held in the cloud, because it's on servers that are usually outside the UK and the police cannot access them without permission.
If they can get the person to give them passwords then they could get in that way, or else they would have to request access from the owners of the data, which can take a long time.
They don't appear to do either of things for most investigations. They just look at what is on the devices.
If they can get the person to give them passwords then they could get in that way, or else they would have to request access from the owners of the data, which can take a long time.
They don't appear to do either of things for most investigations. They just look at what is on the devices.
if you have the passwords saved on your phone technically they could access them immediately though. I just don't understand if they do this on the day of seizure or when the forensics folks look at the phone months later. Because in that time much of the data could be lost.
In my person's case the evidence was on the cloud. So they took devices but also downloaded everything off the cloud before the person was released from custody. They got special permission to hold him longer than normal because it took so long to download.
So they definitely can download from the cloud, but I don't know if it is routine in every case.
So they definitely can download from the cloud, but I don't know if it is routine in every case.
I think it may be more routine these days if the local force has the equipment. Did they know that's where the evidence would be beforehand?
My person gave them his passwords as they were alone in the house with our child getting ready for school run. They threatened to send my child into temporary care unless he unlocked the phone to call someone to come look after our child.
Also the police had special software and copied everything from the phone, all devices and cloud. They put a rush on ours because there was so much (a TB of data) and we're probably expecting loads. They run it through special software that does a report on what's been found then the officer in charge does a report on what they've found. They found 1catA 1catB in hidden/cached memory he claims not to recognise and a fantasy chat. Devastating but I was expecting for that volume of data....much much worse.
Also the police had special software and copied everything from the phone, all devices and cloud. They put a rush on ours because there was so much (a TB of data) and we're probably expecting loads. They run it through special software that does a report on what's been found then the officer in charge does a report on what they've found. They found 1catA 1catB in hidden/cached memory he claims not to recognise and a fantasy chat. Devastating but I was expecting for that volume of data....much much worse.
Thanks, Holdingthegrenade. That's a bold tactic they used to get the passwords. I'm not sure they can do that, it either has to be voluntary or after they served you with an order saying that if you don't give them the password they will prosecute you. But then you have a timeframe to comply.
So they downloaded everything in the house or while your person was in custody?
So they downloaded everything in the house or while your person was in custody?
Yes, in my person's case they did already know the evidence was in the cloud.
They analysed it pretty quickly too as they asked me back the next day with another image they wanted context on.
They analysed it pretty quickly too as they asked me back the next day with another image they wanted context on.
Thank you. It seems even solicitor doesn't know what the routine is even though they're dealing with cases in the region every week.
Hi,
they arrested my person took all our stuff from the house inc the phone after they'd unlocked it. Whilst being interviewed they took his stuff with the passwords and kept it until they could download everything off the devices and the cloud. He stupidly didn't think he'd done anything wrong so was 100% cooperative. They then did a report to see what was on them. We got everything back except the phone, they won't give you stuff back if it's got "evidence" on it. So thankfully all our family holiday photos, home computer, kids tablets etc were returned. But if there'd been one image in amongst everything else on our devices we'd lose that device and everything on it as they have to destroy it to make sure the images etc can't be shared further.
thats what I was told anyway
they arrested my person took all our stuff from the house inc the phone after they'd unlocked it. Whilst being interviewed they took his stuff with the passwords and kept it until they could download everything off the devices and the cloud. He stupidly didn't think he'd done anything wrong so was 100% cooperative. They then did a report to see what was on them. We got everything back except the phone, they won't give you stuff back if it's got "evidence" on it. So thankfully all our family holiday photos, home computer, kids tablets etc were returned. But if there'd been one image in amongst everything else on our devices we'd lose that device and everything on it as they have to destroy it to make sure the images etc can't be shared further.
thats what I was told anyway
That's interesting that they copy stuff at the station. I think most people's perception is that they only do this once it is sent to the actual forensics lab. I was wondering this because my person was in a cell for 5-6 hours before he was interviewed, did make me wonder why they were holding for so long. I guess they may have different approaches in different regions though.
Did you get told what was on it after the full forensic examination at the lab and the second interview or did they tell you as soon as they had downloaded his stuff? We haven't heard anything yet.
Did you get told what was on it after the full forensic examination at the lab and the second interview or did they tell you as soon as they had downloaded his stuff? We haven't heard anything yet.