Apple ecosystem
Available iCloud device backups, synchronised account content, photographs, contacts, files and related Apple-device sources.
Account, backup and synchronised evidence
Mobile cloud
Forensics.
Lawful acquisition and examination of available cloud and account data can extend, corroborate or qualify what remains on a handset. It is a complementary evidence route, not a guaranteed substitute for the device.
Potential sources
Evidence beyond
the handset.
We identify relevant services, confirm authority and access, preserve available data and document what the provider returned. Service support, content and authentication requirements change over time.
Google ecosystem
Available Google Timeline or location-related records from supported device, account or exported sources, plus Google Drive, Gmail, Keep, account activity, synchronised records and Android backup material.
Messaging services
Available WhatsApp backups or authorised account collection, Telegram cloud chats and other service-held records where supported.
Microsoft and email
Available Microsoft 365, OneDrive and mailbox data, plus supported email accounts collected through authorised service access.
Huawei services
Available Huawei account, backup and synchronisation material considered alongside compatible device evidence.
Social and storage
Available hosted social-media, content-sharing and cloud-storage records relevant to the agreed instruction.
Critical qualification
Configured, retained
and lawfully accessible.
Availability depends on the service and region, account configuration, credentials or valid session material, multi-factor authentication, encryption, retention, subscription status, provider changes and lawful authority. A listed source is a potential acquisition route, not a promise that a particular account or item can be recovered.
Examination scope
Collect.
Correlate.
Qualify.
01Authority, account ownership, relevant dates and proportional scope confirmed.
02Authentication and multi-factor requirements assessed without unsafe credential transmission.
03Provider-returned data preserved with acquisition records and integrity information where available.
04Cloud records correlated with the handset, backups, linked devices and counterpart evidence.
05Missing fields, changed media, unsuccessful access and service limitations reported expressly.
Imported evidence
Existing forensic
images and exports.
Where direct acquisition is unavailable or another examiner has already collected the data, we can assess compatible mobile backups, file-system images, third-party forensic exports, device images and selected low-level acquisitions. Provenance and completeness are checked before reliance.
Source-specific scope
Cloud capability
and evidence routes.
Documentation-check dates are shown beside each source. These dates record documentation checks, not tests of D3's installed tools. Reconfirm access, region, version, authority and collection effects for every instruction.
Scroll horizontally on narrow screens. An unsupported route, failed authentication and a successful return with no relevant records are different outcomes and must be reported separately.
| Source | Route | Dependencies | Limits | Documentation |
|---|---|---|---|---|
| Apple iCloud | Device backup and synchronised content | Account, trusted access and configured encryption | Not a universal snapshot; Messages in iCloud and ADP change availability | Apple iCloud data protection What iCloud backs up |
| Google accounts | Available Drive, Gmail, Keep and account exports | Account permissions and MFA; service-specific support | Timeline may be device-held with optional encrypted backup; do not assume server history | Google Account: download your data Google Maps Timeline |
| Application backup or separately authorised linked session | Account matching and configured recovery mechanism | Linking alters state and can notify; partial synchronisation is not historic recovery | WhatsApp linked-device history WhatsApp linked devices | |
| Signal | Optional Secure Backup; existing endpoint evidence | Prior enablement, retained archive and required key | User restoration support is not validated forensic connector support; exclusions apply | Signal Secure Backups |
| Telegram | Authorised cloud chats or exports | Account access and collection scope | Secret chats are device-specific and absent from cloud-chat exports | Telegram FAQ |
| Teams | Tenant compliance/eDiscovery collections | Roles, licences, retention and authority | Compliance copies differ from live stores; collect relevant files separately | Microsoft Purview: Teams evidence |
| Slack | Authorised workspace exports | Plan, role, approval and retention | Export scope varies; links do not preserve file binaries | Slack workspace exports Reading Slack exports |
| Lark / Feishu | Selective exports or scoped authorised API | Deployment, permissions, app scopes and membership | Editable exported documents are not native complete acquisitions | Lark message-to-document export Feishu message API |
| Huawei, other mail and storage | Candidate device, account, export or imported-image sources | Confirm the precise service and current access route | Not individually verified as an active connector in this review | Case-specific confirmation required |
Route distinctions
A device backup is a configured snapshot. Synchronisation can propagate changes. A provider export is a selected representation. Direct account collection depends on supported interfaces and authority. A linked session may change account state. An imported image is an existing acquisition whose provenance and scope must be checked.
Cross-border and account effects
Confirm applicable jurisdiction, authority, proportional scope, storage and transfer arrangements before collection. Access can generate account events or notifications. Provider formats, fields, authentication and retention can change or fail. No account ownership or administrator role alone establishes authority over every third-party record.
Credential and evidence-transfer protocolConfidential case review
