Peripheral, Portable and Cloud Storage Evidence

Why This Topic Matters

When most people think of digital evidence, they picture a suspect's desktop or laptop computer. In reality, a fraud examiner who stops there will miss a large portion of the available evidence. Modern business data lives in printers, copiers, USB drives, smartphones, tablets, external hard drives, memory cards, wearables, and, increasingly, in cloud services such as Google Drive, Dropbox, Microsoft OneDrive, iCloud, and enterprise platforms like SharePoint or Salesforce.

The ACFE places this topic within the Investigation section of the CFE Exam, under Collecting Evidence and specifically within the digital forensics material. It is important for three reasons:

1. Completeness of the investigation. Fraudsters frequently move incriminating data off their primary computer onto thumb drives, personal phones, or personal cloud accounts precisely because they believe those locations will not be searched.
2. Fragility of the evidence. Portable devices can be lost, wiped remotely, or overwritten quickly; cloud data can be deleted by the user or purged by the provider under retention policies. Evidence that is not identified and preserved early may be gone forever.
3. Legal admissibility. Each category of device carries unique chain-of-custody, privacy, and jurisdictional issues. Mishandling can make otherwise devastating evidence inadmissible.

On the exam, this topic is tested through scenario questions that ask you to identify the best collection practice, recognize overlooked sources of evidence, and understand the legal and practical obstacles unique to each device type.


What It Is: Defining the Three Categories

1. Peripheral Devices
Peripherals are hardware components connected to a computer or network that are not the computer itself. Many contain internal memory or hard drives that retain data. Examples include:
- Printers, copiers, scanners, and multifunction devices: Modern digital copiers typically contain hard drives that store images of every document copied, printed, scanned, or faxed, sometimes for years.
- Fax machines: Store logs of numbers dialed and received, and often copies of transmitted pages.
- Routers, switches, and firewalls: Hold logs of network traffic, connected devices, and access times.
- External monitors, keyboards, and mice: Generally hold no evidence, but keyboard loggers (hardware devices placed between keyboard and computer) may be found here.
- Smart devices: Smart TVs, voice assistants, security cameras, gaming consoles, and Internet of Things (IoT) devices may contain logs, recordings, or stored files.
- Digital cameras, GPS units, and dash cams: Store images, video, location histories, and metadata such as timestamps.

2. Portable Devices and Removable Media
Portable storage is any device designed to be carried and used across multiple machines. Examples include:
- USB flash drives (thumb drives)
- External hard drives and solid-state drives
- SD cards, microSD cards, CompactFlash, and other memory cards
- CDs, DVDs, and Blu-ray discs
- Smartphones and tablets (which function both as computers and as removable storage)
- Laptops
- Wearables such as smartwatches and fitness trackers
- MP3 players, e-readers, and digital voice recorders

Portable devices are attractive to fraudsters because they are easy to conceal, easy to transport past security, and easy to destroy. For the examiner, they are challenging because they are easy to overlook and because their data can be modified or wiped quickly.

3. Cloud Storage
Cloud storage refers to data stored on remote servers owned and operated by a third-party service provider and accessed over the internet. Categories include:
- Consumer file storage: Dropbox, Google Drive, OneDrive, iCloud, Box.
- Webmail and messaging: Gmail, Outlook.com, Yahoo Mail, WhatsApp, Signal, Slack.
- Enterprise Software as a Service (SaaS): Microsoft 365, Google Workspace, Salesforce, QuickBooks Online, NetSuite.
- Infrastructure and Platform services: Amazon Web Services, Microsoft Azure, Google Cloud, where an organization may host its own servers and databases.
- Social media and backup services: Facebook, Instagram, LinkedIn, automated phone backups.

Cloud evidence differs fundamentally from device-based evidence because the examiner usually does not have physical possession of the storage medium. The data may be spread across multiple servers in multiple countries, co-mingled with other customers' data (multi-tenancy), and subject to the provider's terms of service and retention schedules.


How It Works: Collection Principles and Procedures

Universal Digital Evidence Principles (Apply to All Three Categories)

Before examining each category, remember the core rules of digital forensics that the CFE Exam expects you to know:

- Obtain legal authority first. Confirm that the organization owns the device or data, or that you have consent, a court order, a subpoena, or a search warrant. Employee-owned devices (Bring Your Own Device, or BYOD) and personal cloud accounts raise significant privacy concerns.
- Do not alter the original. Work from a forensic image (a bit-by-bit copy) rather than the original device whenever possible. Use hardware write blockers when imaging storage media so that no data is written to the source.
- Verify integrity with hash values. Calculate a cryptographic hash (such as MD5 or SHA-256) of the original and the copy. Matching hashes prove the copy is identical and that the evidence has not changed.
- Document everything. Photograph devices in place before touching them, record make, model, serial numbers, condition, connections, and the state of the screen. Log who handled the evidence, when, and why.
- Maintain chain of custody. Every transfer of possession must be recorded. Store evidence in secure, access-controlled, environmentally appropriate locations.
- Use qualified specialists. Fraud examiners should recognize when a trained digital forensic examiner is needed rather than attempting a technical extraction themselves. Improper handling can destroy evidence and credibility.

Collecting Evidence from Peripheral Devices

- Identify all connected and nearby devices. Trace cables, check for wireless connections, and inventory everything in the workspace. Ask about shared printers and copiers on the network.
- Copiers and multifunction printers. Determine whether the device has an internal hard drive. If so, it may be imaged like a computer hard drive, often by removing the drive or using vendor tools. Check whether the device has a data security kit that automatically overwrites stored images. Be aware that leased copiers are frequently returned to vendors with data intact, so act before lease expiration.
- Network devices. Routers and firewalls hold volatile logs that may be lost on power-down or overwritten as new traffic arrives. Export logs promptly. Note that these devices may also show which portable devices or cloud services were connected to the network.
- Hardware keyloggers and rogue devices. Inspect the back of computers and USB ports for unfamiliar devices.
- Be careful with power. Some peripheral memory is volatile and lost on shutdown; some devices may begin an overwrite cycle on reboot. When uncertain, consult a specialist before powering a device off.

Collecting Evidence from Portable Devices and Removable Media

- Search thoroughly. Thumb drives and memory cards are tiny. Check desk drawers, bags, coat pockets, keychains, camera cases, vehicles, and even inside books or behind pictures. Also search for device packaging or receipts indicating a device exists that has not yet been found.
- Photograph and label. Record exactly where each item was located before collection. Place each item in its own labeled evidence bag. Use anti-static bags for electronic media.
- Image with write blockers. Removable media should be imaged using a write blocker to prevent accidental modification, and hash values should be recorded.
- Mobile phones and tablets require special care. These devices are constantly connected and can be remotely wiped, locked, or updated. Best practice is to isolate the device from all networks immediately by placing it in a Faraday bag (a shielded container that blocks radio signals) or by enabling airplane mode while disabling Wi-Fi and Bluetooth. If the device is on, leave it on, because powering down may trigger encryption or a passcode that cannot be bypassed. Keep the device charged, since a dead battery may have the same effect. Collect chargers and cables along with the device.
- Capture passcodes and credentials where lawful. If the subject consents or is compelled to provide access codes, document them. Note that in many jurisdictions compelling a passcode raises self-incrimination issues.
- Use specialized mobile forensic tools. Logical extractions (visible files and data), file system extractions, and physical extractions (full memory dumps including deleted data) are performed by trained examiners using tools such as Cellebrite or Magnet AXIOM.
- Remember connection artifacts. Even if a thumb drive is never found, the suspect's computer retains registry entries and logs showing what USB devices were connected, their serial numbers, and when. This can prove exfiltration occurred.

Collecting Evidence from Cloud Storage

Cloud evidence is the most procedurally complex of the three categories. Consider the following:

- Act quickly to preserve. Users can delete cloud data instantly, and providers may purge deleted items after a set period. Send a preservation request (sometimes called a litigation hold letter) to the service provider as soon as the account is identified, and place a legal hold on any enterprise accounts under the organization's control.
- Determine who controls the account. If the organization owns the enterprise cloud subscription (for example, corporate Microsoft 365), its administrators can usually access, export, and preserve data directly through administrative or eDiscovery tools, subject to internal policy and applicable privacy law. If the account is personal, the examiner generally needs the user's consent or legal process.
- Understand the legal process required. In the United States, the Stored Communications Act generally prohibits providers from disclosing the content of communications to private parties without user consent; content typically requires a search warrant obtained by law enforcement, while subscriber and transactional records may be obtainable by subpoena or court order. Civil litigants usually must obtain the data from the account holder through discovery rather than from the provider. Outside the United States, data protection laws such as the GDPR in Europe impose additional limits.
- Address jurisdiction and data location. Cloud providers may store data in servers located in several countries. The law of the country where the server sits, the country where the provider is headquartered, and the country where the user resides may all apply. Cross-border requests may require Mutual Legal Assistance Treaties (MLATs) or similar mechanisms, which can be slow.
- Review the provider's terms of service and privacy policy. These documents describe what data the provider retains, for how long, and under what conditions it will be disclosed. Many providers publish law enforcement guides describing the exact legal process they require.
- Look for local copies. Cloud synchronization clients (such as the Dropbox or OneDrive desktop apps) keep local copies of files on the user's computer, along with databases and logs recording what was uploaded, downloaded, shared, and deleted. Browser history, cached web pages, cookies, and saved credentials can reveal which cloud services the subject used. Mobile devices frequently contain cached cloud data as well. These local artifacts are often easier to obtain than data from the provider and may be the key to demonstrating that a cloud account exists.
- Capture cloud evidence defensibly. When exporting data directly from a cloud account (with proper authority), use the provider's export or takeout functions, forensic cloud collection tools, or detailed screen capture with documented timestamps. Record the method, the account, the date and time, and hash values of exported files. Preserve metadata such as creation dates, modification dates, sharing permissions, and version histories, which can be as important as the file content.
- Consider the provider's own logs. Access logs showing IP addresses, device identifiers, login times, and sharing activity can establish who accessed data and when, even if the content itself cannot be obtained.
- Recognize encryption and multi-tenancy limits. Some services use end-to-end encryption that even the provider cannot decrypt. In multi-tenant environments, a provider will not image an entire physical server because it holds other customers' data; instead it produces the specific account's data.


Common Pitfalls the Exam Likes to Test

- Assuming the suspect's computer is the only source of evidence and ignoring copiers, phones, or cloud accounts.
- Powering down a smartphone or leaving it connected to the network, allowing a remote wipe.
- Plugging a thumb drive into an ordinary computer without a write blocker, thereby altering timestamps.
- Failing to send a preservation request, allowing cloud data to be deleted.
- Attempting to obtain cloud content directly from a provider in a civil matter without recognizing that legal process or user consent is required.
- Searching an employee's personal cloud account or personal device without authority, creating privacy liability and risking suppression of evidence.
- Neglecting to document the location and condition of devices before seizure.
- Returning leased copiers to the vendor with hard drives intact, destroying evidence or exposing confidential data.


Exam Tips: Answering Questions on Peripheral, Portable and Cloud Storage Evidence

Tip 1: Think breadth of sources. If a question asks where evidence of a fraud might be found, the correct answer usually includes the broadest reasonable set of sources. Copiers with hard drives, fax logs, USB connection histories, mobile devices, and cloud sync folders are all legitimate sources. Answers that limit the search to the office computer are typically wrong.

Tip 2: Preservation before analysis. When a scenario presents a choice between acting to preserve evidence and acting to analyze it, preservation comes first. Send preservation letters, isolate devices, and image media before examining content.

Tip 3: Isolate mobile devices. Any question about seizing a smartphone or tablet will almost always have a correct answer involving a Faraday bag or network isolation, keeping the device powered and charged, and not attempting to browse through the device. Eliminate answers that involve turning the phone off casually or reading messages on the spot.

Tip 4: Write blockers and hashes. If the question involves copying data from a thumb drive, external hard drive, or memory card, look for the answer mentioning a forensic image created with a write blocker and verified with hash values. Simply copying files with the operating system is not forensically sound.

Tip 5: Legal authority is a threshold issue. Questions often hinge on whether the examiner has the right to access the device or account. Company-owned equipment covered by a clear acceptable-use policy generally may be examined; personal devices and personal cloud accounts generally require consent or legal process. If an answer choice skips this step, be suspicious of it.

Tip 6: Know the cloud roadblocks. Expect questions on why cloud evidence is difficult to obtain. The expected answers include: data may be stored in multiple jurisdictions, providers may refuse disclosure without legal process, terms of service govern retention, data may be encrypted, multi-tenancy prevents server imaging, and users can quickly delete data. Also expect the practical workaround: local sync folders, browser artifacts, and mobile caches on devices you do control.

Tip 7: Civil versus criminal access. Remember that private fraud examiners cannot obtain search warrants. In civil matters, cloud content is normally obtained from the account holder through discovery or consent, not directly from the provider. Law enforcement can use warrants and, for cross-border data, treaty processes.

Tip 8: Metadata counts. Questions may emphasize that version histories, sharing logs, access logs, IP addresses, and timestamps are themselves evidence. Choose answers that preserve metadata rather than just file contents.

Tip 9: Choose the specialist answer. When an answer choice has the fraud examiner personally performing a complex extraction from a phone or copier, and another choice has the examiner securing the device and engaging a qualified digital forensic specialist, the latter is generally correct.

Tip 10: Read for the single best answer. CFE questions frequently offer several answers that are partially correct. Look for the one that combines legal authority, preservation of the original, documentation, and chain of custody. Watch for absolute words such as always or never in distractors, and for answers that are technically possible but legally or procedurally improper.


Practice Scenario

An internal investigation reveals that a purchasing manager suspected of a kickback scheme may have transferred supplier files to a personal Dropbox account and a thumb drive. The manager's company-issued laptop and phone are available, but the thumb drive has not been located. What should the examiner do first?

Reasoning: The examiner should secure and isolate the company phone (Faraday bag, keep charged), forensically image the company laptop, and examine it for USB connection artifacts proving the thumb drive existed and for Dropbox sync client data and browser history pointing to the personal account. A preservation request should be sent to Dropbox and legal counsel consulted about obtaining the personal account content through consent or discovery, since the examiner cannot compel the provider directly. Searching the personal account without authority would be improper. This combination of preservation, use of controlled devices, and respect for legal limits reflects the approach the exam rewards.


Key Takeaways

- Evidence lives far beyond the main computer: copiers, routers, cameras, USB drives, memory cards, phones, wearables, and cloud accounts all matter.
- Peripherals such as copiers often contain hard drives storing every document processed.
- Portable media must be imaged with write blockers and verified by hashing; mobile devices must be isolated from networks and kept powered.
- Cloud evidence requires rapid preservation requests, an understanding of who controls the account, awareness of jurisdictional and statutory limits, and the use of local sync and browser artifacts as a practical alternative.
- Every category demands legal authority, documentation, chain of custody, and, where technical complexity exists, a qualified digital forensic specialist.

Master these principles and you will be well prepared for the Collecting Evidence questions on peripheral, portable, and cloud storage evidence on the CFE Exam.