MOBILE FORENSICS

Google Account and Google Cloud artefacts

A Google Account is the central identity of an Android device. It links numerous Google services such as Gmail, Contacts, Calendar, Google Drive, Google Photos and the Play Store. As part of a digital forensics investigation, local and cloud-based artefacts can provide valuable insights into how a device has been used.

Google account
Google Drive
Google Photos
Gmail
Contacts and Calendar
Google One
Google Play Services
Synchronisation information
Authentication and account metadata
Device assignments

TECHNICAL BACKGROUND

Technical Fundamentals

Depending on the Android version, account settings and synchronisation, various artefacts may be present.

Areas of forensic relevance include, amongst others:

  • •Google account
  • •Google Drive
  • •Google Photos
  • •Gmail
  • •Contacts and Calendar
  • •Google One
  • •Google Play Services
  • •Synchronisation information
  • •Authentication and account metadata
  • •Device assignments

The information available depends on the existing data sources and the legal and technical framework.

OUR APPROACH

This is how your examination will be carried out

A transparent process – from the initial enquiry to the handover of the report.

1
Following the forensic data backup, local account artefacts and – where available and permissible – cloud-related information are analysed. Account metadata, synchronisation details and timestamps are correlated with other artefacts in order to objectively illustrate technical relationships. All stages of the investigation are documented in a transparent manner.
2
LanCologne produces expert reports for private individuals, as well as for companies and solicitors. Our reports have already been used in court proceedings. In some cases, we have been directly commissioned to produce IT forensic reports. Upon request, we can provide anonymised or redacted sample reports or extracts.

TYPICAL QUESTIONS

When is this analysis required?

  • ✔Which Google accounts are linked to the device?
  • ✔Which cloud services were used?
  • ✔What data has been synchronised?
  • ✔Which devices are linked to an account?
  • ✔What technical conclusions can be drawn?

LIMITATIONS & CONCLUSION

What you should know

Not all cloud data is available locally. The scope and availability depend on the synchronisation settings, the applicable access rights, data backup procedures, and the technical and legal requirements.

Google Account and Cloud artefacts often provide important clues about the use of an Android device. However, their significance only becomes apparent when they are assessed in conjunction with other forensic data sources.

CUSTOMER REVIEWS

What our customers say

4.8 out of 5 stars on Trustpilot · 54 reviews

★★★★★

“The highest standards of professionalism, prompt service and excellent communication. They made the seemingly impossible a reality. This is what genuine customer service is all about – unrivalled in Germany!”

idalein

Verified review on Trustpilot

★★★★★

“Very helpful advice, excellent responsiveness and communication. My problem was completely resolved and the lost data was recovered. I’m very satisfied and, of course, relieved!”

Layla Pankratz

Verified review on Trustpilot

★★★★★

“My problem was sorted out professionally and quickly; everyone I spoke to was always friendly, and I can still get in touch if I have any questions – I’m very grateful for that!”

a woman from Cologne

Verified review on Trustpilot

Enquire now – free initial consultation

Would you like to have the Google Account or cloud data from an Android device professionally examined? LanCologne can assist you with an objective IT forensic analysis and comprehensive expert documentation.

RELATED TOPICS

You might also be interested in

FREQUENTLY ASKED QUESTIONS

Frequently Asked Questions

Click on a question to see the answer.

Which Google services are relevant from a forensic perspective?
These include Gmail, Google Drive, Google Photos, Contacts, Calendar and Google Play Services, amongst others.
Is cloud data always stored locally?
No. A lot of the information is stored exclusively in the cloud or is only partially synchronised.
Is it possible to trace the device allocation?
Depending on the artefacts available, there may be relevant information.
Can synchronisation times be analysed?
In some cases, provided that the relevant metadata is available.
Can an expert report be drawn up?
Yes. The results of the investigations can be documented and assessed in a transparent manner.