Third-party applications like file sharing in particular often make use of cloud storage to retain important user data, and therefore many times, actual user content may not be located on a device. It is more common to locate evidence that a file-sharing application was utilized on a device rather than the files themselves. If you locate an application that has the properties of a file-sharing program, look outside your application of interest for other key artifacts.

File sharing is often completed outside of the actual file-sharing application itself, so start examining the other applications that can be used to share your data. Review data outside of its native application directory for supplementary evidence.

In the example above, a Dropbox link was shared via iMessage. The link was clicked and opened within the Safari browser. Now evidence of Dropbox usage could be located in:

•  the Dropbox application directory.

•  the database containing iMessages.

•  the Safari browser database.

Always review alternative chat applications for shared data, as well as those native to the device and email and browser history for additional data. A keyword search would be beneficial in narrowing down data for this type of search.