Web and mobile forensics

Overview
Web and mobile forensics are "driven by the recent and rapid rise of cloud computing and Web 2.0 services and mobile devices like smart phones and personal digital assistants (PDAs). Many high-profile individuals (writers, politicians, and others likely to become donors of personal papers) lead active online lives, participating in communities like Facebook, MySpace, Flickr, Google (and using applications like Google Docs), Twitter, and even virtual worlds like Second Life. E-mail may be stored locally, in the cloud, or both. The challenges here are legal as well as technical: different Web services are governed by different end-user license agreements, and too often these do not include provisions for access even by family members or next of kin, let alone archivists. Remote backup providers like iDisk or Carbonite present the same issues. It is not difficult to foresee a time when hands-on access to a physical piece of media containing the data of interest will be the rarity for the archivist. Similarly, the growing popularity of smart phones, PDAs, tablet computers, and other devices with the potential to store all manner of information, including e-mail, text, video, voice messages, contacts, Web-browsing activity, and more, will present new challenges for the archivist in the not-too-distant future. Indeed, mobile forensics is already a major growth area in the commercial forensics industry and even in the consumer market, where readily available subscriber identity module (SIM) card readers facilitate the recovery of deleted contacts and text messages.

"There are no absolute boundaries between the cloud and a local file system, or between mobile devices and a file system. Browser caches may reveal evidence of online activity, passwords for Web services may be discovered on local systems (or even on notes in the desk drawer next to them), and mobile devices may back up to a desktop or laptop computer &mdash; or the cloud. Future archivists will clearly need to contend with a fluid information ecology spanning all current classes of devices and services. For the time being, however, especially as archivists contend with the legacy of the first several decades of personal computing, local file systems and removable media are likely to remain the primary venue for their work."

Source

 * Digital Forensics and Born-Digital Content in Cultural Heritage Collections, at 4-5.