Mobile Forensics · Cloud & Account Evidence · Lesson 2 of 5

Downloading Your Own Data

Export what Google and Apple hold about an account, and know what's left out.

Asking a company for your copy

The simplest way to see what a company holds about an account is to ask for it as the account holder. Both Google and Apple offer self-service export tools, and laws such as the EU's General Data Protection Regulation (GDPR) give people a right to access their personal data.

Google Takeout, at takeout.google.com, exports data from Google products. Products that hold data are preselected, and you uncheck any you don't want. You pick how to receive the archive, as an emailed download link or saved to Google Drive, Dropbox, OneDrive or Box. You also pick a file type (Zip opens almost anywhere, Tgz may need extra software on Windows) and a maximum file size. Large exports are split into several files. Downloading doesn't delete anything from Google's servers.

Apple's Data & Privacy page, at privacy.apple.com, lets you sign in and choose Request a copy of your data. Apple first checks that you're really the account holder. Its list of categories includes:

• Apple Account details and sign-in records
• iCloud data such as contacts, calendars, notes, reminders, email, photos and documents
• usage information for services such as iCloud and Apple Music
• App Store, Apple Books and Apple Store purchase and support records

Notice what's missing. Apple says it can't provide data stored in an end-to-end encrypted format it can't decrypt, and message content isn't included. So an Apple export won't contain anything you've put under Advanced Data Protection, and it won't contain end-to-end encrypted categories such as Messages in iCloud. An export also reflects the account as it is now. Items the person has already deleted, and that have aged out of any trash folder, generally won't appear.

Exports are a mirror of the account, not of the phone. Device-only data from the last module won't be in them.

Consent reviews and timing

Exports matter for investigators too. When a person agrees to share their own account data, for example a victim of online harassment who wants to show the messages and sign-in records, the person can make the export themselves. This is a consent-based collection: the account holder gives permission, and the review stays within what they agreed to share.

A careful consent review looks like this:

• Get written consent that says which account, which kinds of data and which time period are covered.
• Let the account holder sign in and request the export. Investigators should never use someone else's password without clear authority, and signing in to an account without permission is a crime in many places.
• Record when the export was requested and received.
• Compute a hash (a digital fingerprint that changes completely if a single bit changes) of each downloaded file, so anyone can later check that it hasn't been altered.
• Review only the categories the consent covers.

Consent can usually be withdrawn, so note the date and scope clearly.

Timing is the other trap. Google says a Takeout export can take from a few minutes to a few days, and most people get their link the same day. The archive then expires in about 7 days, and each archive can be downloaded only 5 times. After that you need a new one. Google also offers scheduled exports every 2 months for a year. Apple prepares the copy and notifies you on the Data & Privacy page, then gives you 14 days to download it before you must ask again.

Both windows are short. If a download is late, the fix is simply a fresh request, but the new export reflects the account on the new date, which may differ from the first.