Google Drive Forensics

Google Drive is a popular application that features online creation, storage, sharing, editing, and deleting data. People and businesses are using Google Drive to conduct their daily activities. However, the fast growth of computer connectivity and the misuse of cloud storage services provide criminals the opportunity to commit cybercrimes. The rapid development of technology is forcing digital forensics examiners to seek and develop new investigative analysis methods and techniques. The purpose of this research was to explore how investigators can uncover artifacts left by the Google Drive application when using Google Chrome, Internet Explorer, and Mozilla Firefox from devices that utilize the Windows 10 operating systems. This study defined the tools and methodology to identify, collect, preserve, and analyze artifacts left by the Google Drive application when using Google Chrome, Internet Explorer and Mozilla Firefox from devices that utilize Windows 10 operating systems. This research found artifacts and remnants left behind in Windows 10 operating systems by Google Drive applications, including prefetch files, registry files, registry hives, event logs, MFT files, memory, recycle bin, quick access, and web browser history. This research recommended further research regarding the artifacts and remnants left behind when using Google Drive with Google Drive desktop application and other operating systems. These systems include Apple macOS, Google's Android OS, Apple iOS, and Linux Operating Systems. Keywords: Cybersecurity, Doctor Donnie Wendt, Digital Forensics, Google Drive forensics, Google Drive, Windows 10, Google Chrome, Mozilla Firefox, Internet Explorer