Where Is Data Stored?

Determining where data is stored is a necessary part of every digital forensics case. When a user creates a file, it must be stored somewhere. A computer can also create other files in the background that can be just as crucial to a case. For example, an examiner could determine at which point a document was modified or which user accessed it. Depending on where the file is stored, it can drastically change what digital evidence can be extracted. There are three main locations for data storage called: Local Storage, Cloud Storage, and Hybrid Cloud Storage.

Storage Locations

1) Local – Local storage is defined as a data storage method that stores data physically on a local device. Some examples of these are: hard drives, SD cards, solid state drives.

2) Cloud – Cloud storage is a data storage method that allows for data to be stored remotely but be accessed from any location. Some examples of this are: Dropbox, Google Drive, iCloud, OneDrive.

3) Hybrid – Hybrid cloud storage is a combination of both local and cloud storage. This method is used to store internal data on a private network that is used in unison with public cloud. Some examples include: Amazon Virtual Private Cloud (VPC), Microsoft Azure Stack, IBM® Cloud Private.

Do I Need an Expert?

Although data storage methods can vary greatly within a business, digital forensics can be used on any storage infrastructure. In many cases, a combination of storage methods is used. A business may store all work-related files on a cloud-based application, but an employee may store sensitive files to a case on their local computer. These multifaceted infrastructures can become very complex and it’s valuable to seek an expert in these situations.