Magnet Virtual Summit // Taking A Byte of Chromebook Analysis

A new challenge of forensics is upon us as Chromebooks become more and more popular. One of the challenges is understanding the difference obtained from different types of acquisitions as well as the cloud. Due to this challenge, a group of 30 forensic examiners came together to workshop the problem at a Brews and Bytes event in Denver, Colorado. From that perch in the mile high city, we assessed the data in the cloud, as well as more terrestrial images from Chromium VM and data from Chromebook acquisitions. The analysis team looked at different locations where data can reside and compared the different types of acquisitions. The team then continued to build on the one day workshop to develop the comparative analysis we will present of the types of data that can be recovered from different sources associated with Chromebooks and where it resides.