# Cloud Foreniscs **URL:** \ **Category:** Autopsy Help\ **Created:** [September 22, 2021, 5:00pm UTC](https://sleuthkit.discourse.group/t/cloud-foreniscs/2847 "2021-09-22T17:00:20Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![jamieslack](https://avatars.discourse-cdn.com/v4/letter/j/8797f3/32.png) [@jamieslack](https://sleuthkit.discourse.group/u/jamieslack)\ **Post date:** [September 22, 2021, 5:00pm UTC](https://sleuthkit.discourse.group/t/cloud-foreniscs/2847/1 "2021-09-22T17:00:20Z")
Hello! I am a final year student looking to do my dissertation in cloud storage forensic and wondering whether Autopsy is capable of finding artefacts for cloud storage? Could you let me know if Autopsy is something i could use ? ---
**Author:** ![Mark\_McKinnon](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/mark_mckinnon/32/42_2.png) [@Mark\_McKinnon](https://sleuthkit.discourse.group/u/Mark_McKinnon)\ **Post date:** [September 22, 2021, 5:39pm UTC](https://sleuthkit.discourse.group/t/cloud-foreniscs/2847/2 "2021-09-22T17:39:37Z")
At this point, the only thing that Autopsy will do out of the box is identify cloud storage applications based on executable programs that may be on the system you are examining. Here is the list of applications it will look for [autopsy/Cloud Storage.xml at develop · sleuthkit/autopsy · GitHub](https://github.com/sleuthkit/autopsy/blob/develop/thirdparty/InterestingFileSetRules/Cloud%20Storage.xml) I also believe there is a 3rd party python module that mey look at Google drive stuff. Other than that you are welcome to develop a 3rd party module to do what you want. ---
**Author:** ![Richard\_Cordovano](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/richard_cordovano/32/15_2.png) [@Richard\_Cordovano](https://sleuthkit.discourse.group/u/Richard_Cordovano)\ **Post date:** [September 24, 2021, 3:49pm UTC](https://sleuthkit.discourse.group/t/cloud-foreniscs/2847/3 "2021-09-24T15:49:45Z")
@jamieslack, elaborating on what @Mark_McKinnon said (thanks, Mark!), the capability Mark is describing appears in the GUI as follows: ![image](https://global.discourse-cdn.com/free1/uploads/sleuthkit/original/2X/2/24cd2d62a6198eeab4751eda8c8d76a6f3a088dd.png)