Forensic Analysis and Remote Evidence Recovery from Syncthing: An Open Source Decentralised File Synchronisation Utility

Conor Quinn; Mark Scanlon; Jason Farina; M. Kechadi

Digital Forensics and Cyber Crime. 7th International Conference, ICDF2C 2015, Seoul, South Korea, October 6–8, 2015, Revised Selected Papers

Research Article

Forensic Analysis and Remote Evidence Recovery from Syncthing: An Open Source Decentralised File Synchronisation Utility

Download

504 downloads

Cite: BibTeX Plain Text

@INPROCEEDINGS{10.1007/978-3-319-25512-5_7,
    author={Conor Quinn and Mark Scanlon and Jason Farina and M. Kechadi},
    title={Forensic Analysis and Remote Evidence Recovery from Syncthing: An Open Source Decentralised File Synchronisation Utility},
    proceedings={Digital Forensics and Cyber Crime. 7th International Conference, ICDF2C 2015, Seoul, South Korea, October 6--8, 2015, Revised Selected Papers},
    proceedings_a={ICDF2C},
    year={2015},
    month={10},
    keywords={Syncthing Digital forensics Remote forensics Network analysis Evidence recovery},
    doi={10.1007/978-3-319-25512-5_7}
}

Conor Quinn
Mark Scanlon
Jason Farina
M. Kechadi
Year: 2015
Forensic Analysis and Remote Evidence Recovery from Syncthing: An Open Source Decentralised File Synchronisation Utility
ICDF2C
Springer
DOI: 10.1007/978-3-319-25512-5_7

Conor Quinn¹^,*, Mark Scanlon¹^,*, Jason Farina¹^,*, M. Kechadi¹^,*

1: University College Dublin

*Contact email: conor.quinn@ucdconnect.ie, mark.scanlon@ucd.ie, jason.farina@ucdconnect.ie, tahar.kechadi@ucd.ie

Abstract

Commercial and home Internet users are becoming increasingly concerned with data protection and privacy. Questions have been raised regarding the privacy afforded by popular cloud-based file synchronisation services such as Dropbox, OneDrive and Google Drive. A number of these services have recently been reported as sharing information with governmental security agencies without the need for warrants to be granted. As a result, many users are opting for decentralised (cloudless) file synchronisation alternatives to the aforementioned cloud solutions. This paper outlines the forensic analysis and applies remote evidence recovery techniques for one such decentralised service, Syncthing.

Keywords: Syncthing Digital forensics Remote forensics Network analysis Evidence recovery

Published: 2015-10-05
Appears in: SpringerLink

: http://dx.doi.org/10.1007/978-3-319-25512-5_7