The increasing usage of mobile cloud computing leads the cloud to become a hotbed of crime. Cloud storage is different from previous data storage in digital forensics. In this paper, we concentrate on gathering evidence from mobile iOS devices and the types of data remnants that can be found on iOS devices for different user scenarios and device states. We develop several steps for experimenting on Google Drive, OneDrive and Dropbox. We found that the evidence collection of power-off state is not the major problem in digital forensics. Different applications of cloud storage show the different statuses of data remnants. The study also shows that thumbnails and cache files are the key of evidence recovery. We present how the digital investigators to collect evidence by examining the data remnants files as well.

中文翻译：

---

存储服务与iOS系统对接的云证据轨迹

移动云计算使用量的增加导致云成为犯罪的温床。云存储不同于以往数字取证中的数据存储。在本文中，我们专注于从移动 iOS 设备收集证据以及可以在 iOS 设备上针对不同用户场景和设备状态找到的数据残余类型。我们开发了几个步骤来在 Google Drive、OneDrive 和 Dropbox 上进行试验。我们发现断电状态的取证并不是数字取证的主要问题。云存储的不同应用表现出数据残余的不同状态。研究还表明，缩略图和缓存文件是证据恢复的关键。我们还介绍了数字调查员如何通过检查数据残余文件来收集证据。