BEGIN:VCALENDAR
PRODID:-//vBulletin 6//EN
VERSION:2.0
CALSCALE:GREGORIAN
BEGIN:VEVENT
UID:30e48afd-334a-4a4e-9fa4-bf357c1a4210
DTSTAMP:20260522T134323Z
SUMMARY:Discovering Cloud File Storage Artifacts
DESCRIPTION:Title: Discovering Cloud File Storage Artifacts\n\nDescription:
 \nOrganizational data is rapidly moving to the cloud\, but it's not always
  intentional. The shift from on-premise data storage to the cloud constitu
 tes a significant challenge and risk to the modern enterprise. The use of 
 cloud file storage applications is on the rise for both consumer and busin
 ess systems\, which results in interesting data and metadata siting on end
 points. In this talk\, we'll examine the large footprints of popular cloud
  file storage applications such as OneDrive and Box - learning what inform
 ation can be enumerated from each cloud file storage solution. In some sce
 narios\, data can be carved out from cache\, restoring sensitive documents
  no longer on an endpoint.\n\nAttendees will:\n\n- Understand why it's cri
 tical to investigate cloud file storage applications during an incident\n-
  Learn what files are available to examiners during an incident (e.g. loca
 l\, cloud\, deleted\, and cached)\n- See what kind of cloud file storage u
 ser activity can be audited\n- Be introduced to two scenarios of unauthori
 zed data transfer to investigate\n- Be introduced to where and how differe
 nt cloud file storage applications log\n- Learn how to examine incidents w
 ith suspected data exfiltration using corporate issued and person cloud fi
 le storage use\n\nThe slides and labs will take a deep dive into Microsoft
  OneDrive\, Google Drive\, Dropbox\, Box\, and Citrix ShareFile to first u
 nderstand what is known about the applications and artifacts left behind\,
  then move into hands-on labs to analyze registry keys\, log files\, and o
 ther traces left behind by the applications.\n\n=====\n\nYouTube: https://
 www.youtube.com/watch?v=gwBG_oKDINQ\n\n#cloudv-general-text: https://disco
 rd.com/channels/708208267699945503/732733373172285520\n\nSpeaker(s): Micha
 el Wylie\n\nLocation: Cloud Vlg\n\nDiscord: https://discord.com/channels/7
 08208267699945503/732733373172285520\n\nEvent starts: 2020-08-08 15:30 (03
 :30 PM) PDT (UTC -07:00)\n\nEvent ends: 2020-08-08 17:30 (05:30 PM) PDT (U
 TC -07:00)\n\nFor the most up-to-date information\, please either visit ht
 tps://info.defcon.org\, or use HackerTracker\, which is available for iOS 
 and Android. This is an automated message\, and this data was last modifie
 d 2020-08-08T05:43 (UTC).
URL:https://forum.defcon.org/node/234725
DTSTART:20200808T233000Z
DTEND:20200809T013001Z
LOCATION:Cloud Vlg
END:VEVENT
END:VCALENDAR