| The increased use of cloud storage services creates the need for examiners to be prepared for all cloud storage options during a forensic analysis. This Capstone paper focuses on the cloud storage service Copy. While similar research has been performed on other cloud storage services, a forensic examination baseline of Copy was needed. Background research was performed on the service itself, followed by forensic imaging and analysis. Hard drive images were taken before and after Copy software installation, before and after file synchronization, and following software uninstallation from the test virtual machine. The hard drive images were analyzed to determine directory locations, files associated with Copy, what user information can be identified, and registry and event log changes made to the system. A memory image was taken following file synchronization to search for the user password. A network packet capture was performed during the file synchronization to determine if the synchronization was secure, what IP addresses interact with the transfer, and where they are physically located.;Keywords: Cybersecurity, Professor Cynthia Gonnella, Barracuda Networks, Copy, cloud storage, forensics, virtual machine. |
