Identification and analysis of email and contacts artefacts on iOS and OS X

    Research output: Chapter in Book/Report/Conference proceedingConference contribution

    221 Downloads (Pure)


    Acquiring data from cloud storage services has become increasingly important to digital forensic investigations. As more providers offer greater online storage facilities and user data is synchronised across multiple devices, an abundance of data sources has become available to assist with forensic investigations. However, such data can only become evidence when there is a thorough understanding of the data dynamics between client devices and the cloud, and there are explanations for any variations. This paper documents and analyses the artefacts created by interactions between Apple's cloud service, email and contacts applications. An explanation of why some artefacts synchronised over the cloud do not have matching cryptographic hashes is offered, and the ability to establish email origin on a system of multiple devices sharing a single account is established.
    Original languageEnglish
    Title of host publication11th International Conference on Availability, Reliability and Security (ARES), 2016
    Number of pages7
    ISBN (Electronic)978-1-5090-0990-9
    Publication statusPublished - Dec 2016


    • smart phones
    • digital forensics
    • Apple iOS
    • cloud storage


    Dive into the research topics of 'Identification and analysis of email and contacts artefacts on iOS and OS X'. Together they form a unique fingerprint.

    Cite this