Digital Forensics in Google Drive: Techniques for Extracting and Analyzing Digital Artifacts

Abstract

The problem of cloud forensics is the difficulty in identifying and accessing evidence log. It also used to store illegal and prohibited content. This research proposes to address this problem by developing a comprehensive activity for investigating Google Drive with digital forensics. We will explore the techniques and methodologies required to uncover digital artifacts within Google Drive by using National Institute of Standards and Technology (NIST) method, covering aspects such as user activity logs, file metadata, document revisions, and access permissions. The NIST method consists of collection, interpretation, and reporting activities. Collection activities include protect, acquire and ensure. Interpretation activities include recover, navigate, identify, and analyze. And reporting activities consist of reporting results and writing reports. The result of this paper is by using the DB Browser tool, the artifact such as activity log, file metadata, document revision, and access permission is not present. Meanwhile when using Magnet Axiom, the evidence is found but not related to the scenario. Our aim is to provide a structured approach that digital forensics experts can employ to navigate Google Drive and extract relevant evidence effectively.