Identification and analysis of email and contacts artefacts on iOS and OS X

Kenneth M. Ovens, Gordon Morison

    Research output: Chapter in Book/Report/Conference proceedingConference contribution

    3 Citations (Scopus)
    361 Downloads (Pure)


    Acquiring data from cloud storage services has become increasingly important to digital forensic investigations. As more providers offer greater online storage facilities and user data is synchronised across multiple devices, an abundance of data sources has become available to assist with forensic investigations. However, such data can only become evidence when there is a thorough understanding of the data dynamics between client devices and the cloud, and there are explanations for any variations. This paper documents and analyses the artefacts created by interactions between Apple's cloud service, email and contacts applications. An explanation of why some artefacts synchronised over the cloud do not have matching cryptographic hashes is offered, and the ability to establish email origin on a system of multiple devices sharing a single account is established.
    Original languageEnglish
    Title of host publication11th International Conference on Availability, Reliability and Security (ARES), 2016
    Number of pages7
    ISBN (Electronic)978-1-5090-0990-9
    ISBN (Print)9781509009909
    Publication statusPublished - 15 Dec 2016


    • smart phones
    • digital forensics
    • Apple iOS
    • cloud storage

    ASJC Scopus subject areas

    • Computer Networks and Communications


    Dive into the research topics of 'Identification and analysis of email and contacts artefacts on iOS and OS X'. Together they form a unique fingerprint.

    Cite this