Exploring Dropbox image downloads to iPhone via safari: File system versus camera roll validation study

Area of Science:

• Digital Forensics
• Cybersecurity
• Mobile Device Forensics

Background:

• Digital images are critical evidence in legal cases.
• Collecting digital evidence from mobile devices presents unique challenges.
• Standardized forensic tools are not always available for mobile evidence acquisition.

Purpose of the Study:

• To evaluate the forensic integrity of digital images transferred from Dropbox to iPhones using Safari.
• To compare the integrity of images downloaded to the Files app versus the Photos app on iOS devices.
• To determine if this transfer method preserves data integrity for legal admissibility.

Main Methods:

• Quantitative, quasi-experimental design analyzing 60 digital images.
• Testing across three iPhones with iOS versions 14.2 and 14.4.
• Utilizing cryptographic Secure Hash Algorithm 256 (SHA256) for content integrity and Multiscale Structural Similarity Index (MS-SSIM) for quality assessment.

Main Results:

• 100% match in SHA256 stream hashes confirmed unchanged pixel data (content integrity).
• MS-SSIM scores of 1.0 indicated no perceptible image quality degradation.
• File container hashes were altered in the Photos app but not in the Files folder, due to iOS modifications.

Conclusions:

• The transfer method preserves digital image content integrity, supporting compliance with legal standards like Daubert.
• The Files folder maintained container integrity, unlike the Photos app, highlighting structural differences in iOS handling.
• Further research is recommended across diverse iOS versions, cloud platforms, and devices to broaden applicability.