Introduction
MEGA is a cloud storage and file-sharing service that emphasizes privacy and end-to-end encryption. Since its launch in 2013, MEGA has become one of the world’s most widely used secure cloud storage platforms, allowing users to upload, synchronize, store, and share files across computers and mobile devices.
From a digital forensic perspective, MEGA can be a valuable source of evidence because user activities often leave traces on Windows, macOS, Linux, Android, and iOS devices, even though the service is designed with strong encryption and privacy protections.
Investigators may encounter MEGA in criminal investigations, corporate investigations, family law disputes, intellectual property cases, and data theft incidents.
Understanding the history of MEGA and the artefacts it creates is therefore important for digital forensic practitioners.
History of MEGA
MEGA was founded by Kim Dotcom following the shutdown of his previous file-hosting service, Megaupload.
Megaupload Background
Megaupload was launched in 2005 and became one of the largest file-sharing services on the internet. Users could upload files and distribute download links to others.
In January 2012, the service was shut down following a major law enforcement operation involving authorities from multiple countries. Servers were seized and several individuals associated with the company were arrested.
Launch of MEGA
In January 2013, Kim Dotcom launched MEGA as a successor platform. Unlike Megaupload, MEGA was designed with security and privacy as core features.
Key innovations included:
- End-to-end encryption
- Client-side encryption
- Zero-knowledge architecture
- Secure file sharing
- Encrypted messaging capabilities
Under this design, encryption keys are generated on the user’s device, meaning MEGA’s servers generally cannot access the plaintext contents of stored files.
Growth and Development
Over the following years, MEGA expanded its services to include:
- Cloud file storage
- Desktop synchronization applications
- Mobile applications
- Secure collaboration tools
- Secure chat functionality
- Business accounts
- Backup services
Today, MEGA is used by millions of users worldwide for both personal and business file storage.
MEGA Architecture
MEGA operates through several components:
Web Browser Interface
Users can access files through browsers such as:
- Google Chrome
- Mozilla Firefox
- Microsoft Edge
- Safari
Desktop Application
MEGA Desktop App provides:
- File synchronization
- Automatic backups
- Local caching
- Transfer management
Mobile Applications
Available on:
- Android
- iOS
These applications synchronize cloud content with mobile devices and create forensic artefacts.
Digital Forensic Significance of MEGA
MEGA may contain evidence relating to:
- File transfers
- Document storage
- Photographs
- Videos
- Intellectual property theft
- Data exfiltration
- Distribution of illegal content
- User communications
- Cloud backups
Even when files are encrypted, artefacts may reveal:
- User account details
- Login activity
- File names
- Synchronization events
- Shared links
- Access timestamps
Windows MEGA Forensic Artefacts
Installation Evidence
Evidence of installation may be found in the Registry Keys.
Common locations include HKCU\Software\MEGA Limited and HKLM\Software\MEGA Limited
These may contain:
- Installation paths
- User settings
- Application preferences
- Last execution details
Program Files
Typical locations are \Program Files\MEGA\ or \Users\<User>\AppData\Local\MEGA\
Prefetch Artefacts
Windows Prefetch files may confirm execution and can be identified as MEGASYNC.EXE-*.pf and MEGACMD.EXE-*.pf
Prefetch files can reveal:
- Execution counts
- Last execution times
- Referenced files
- Runtime activity
Shortcut Files (LNK)
Windows shortcut files may reveal:
- Recently accessed MEGA files
- Download locations
- User interaction
Common locations are within:
- Recent Items
- AutomaticDestinations
- CustomDestinations
- Jump Lists
Jump Lists may provide evidence of:
- Recently opened files
- Accessed cloud content
- Downloaded documents
MEGA Configuration Files
One of the most important sources of evidence is the MEGA configuration database.
Typical locations include \Users\<User>\AppData\Local\MEGAsync\ and \Users\<User>\AppData\Local\MEGA Desktop App\
Artefacts may contain:
- User email address
- Synchronization settings
- Device identifiers
- Local folder mappings
- Account metadata
SQLite Databases
MEGA applications commonly use SQLite databases.
Potential evidence includes:
- File metadata
- Folder structures
- Synchronization history
- Upload records
- Download records
- Shared folders
Important fields may include:
- File names
- File sizes
- Creation dates
- Modification dates
- Synchronization timestamps
Cache Artefacts
Local caches often contain:
- File thumbnails
- Preview images
- Temporary downloads
- Recently accessed content
Locations may include \AppData\Local\MEGA\ and \AppData\Roaming\MEGA\
These artefacts can sometimes reveal evidence even when original files have been deleted.
Browser-Based MEGA Artefacts
Many users access MEGA exclusively through a browser.
Investigators should examine browser artefacts including:
History Databases
Evidence of:
- Login activity
- Shared links
- File downloads
- Account access
- Cookies
Cookies may contain:
- Session identifiers
- Authentication tokens
- User preferences
- Cache Files
Browser cache may reveal:
- Shared file links
- Images
- Download metadata
Download History
Browser download records may identify:
- Downloaded files
- Download locations
- Download times
MEGA Shared Links
MEGA permits users to generate sharing links.
Evidence may include:
- Shared URLs
- Distribution activity
- Access history
- Shared folder information
Windows Event Logs
Windows Event Logs may reveal:
- Application installation
- Software crashes
- Login events
- Synchronization activity
- Relevant logs include:
- Application Log
- Security Log
- System Log
Android MEGA Forensic Artefacts
Application Directories
Typical locations are /data/data/mega.privacy.android.app/
Artefacts may include:
- Configuration files
- Account information
- Databases
- Cache data
SQLite Databases
Android databases may contain:
- File metadata
- User settings
- Synchronization records
- Recent activity
Cached Files
Potential evidence includes:
- Viewed images
- Downloaded files
- Thumbnails
- Temporary documents
Account Information
Artefacts may reveal:
- Registered email addresses
- Device identifiers
- Synchronization preferences
Depending on Android version and acquisition method, some information may require advanced extraction techniques.
iOS MEGA Forensic Artefacts
Important locations include:
- Applications/MEGA/
- Library/
- Documents/
- Caches/
Potential artefacts include:
- User account data
- Synchronization records
- Download history
- Cached files
- Thumbnail images
File Synchronization Evidence
One of the most valuable artefacts in MEGA investigations is synchronization data which may reveal:
- Files uploaded to cloud storage
- Files downloaded from cloud storage
- Folder mappings
- Synchronization timestamps
Device activity
Investigators can often establish a timeline showing:
- File creation
- Upload to MEGA
- Synchronization
- Sharing activity
- Download activity
Memory Forensics
Live memory analysis may recover:
- User email addresses
- Session tokens
- Encryption keys
- Recently viewed file names
- Cloud metadata
Memory acquisition performed while MEGA is running can provide valuable evidence that may not exist on disk.
Challenges for Digital Investigators
MEGA presents several forensic challenges:
- End-to-End Encryption
- Files stored on MEGA are encrypted before upload.
- Zero-Knowledge Architecture
MEGA claims not to possess users’ encryption keys.
Deleted Data
Deleted content may not be recoverable without additional artefacts.
Encrypted Communications
Shared content and communications may be difficult to interpret without account access.
Investigative Opportunities
Despite encryption, investigators can frequently recover:
- User identities
- Login history
- Synchronization records
- File metadata
- Shared links
- Browser artefacts
- Cache files
- Thumbnail images
- Download records
- Timeline evidence
These artefacts often provide sufficient evidence to demonstrate user interaction with MEGA, even when encrypted file contents cannot be accessed.
Conclusion
MEGA is a privacy-focused cloud storage platform that evolved from the earlier Megaupload service following its closure in 2012. Its emphasis on end-to-end encryption and zero-knowledge storage presents challenges for digital investigators; however, significant forensic artefacts can still be recovered from Windows, macOS, Linux, Android, iOS, browser environments, and memory acquisitions.
Key artefacts include application databases, synchronization records, cache files, registry entries, browser history, shared links, and account metadata.
By correlating these sources, investigators can reconstruct user activity, establish timelines, identify file-sharing behaviour, and demonstrate the use of MEGA services even when the underlying cloud-stored content remains encrypted.
About Athena Forensics
For information on our computer forensic expert services or if you require any advice or assistance please contact a member of our team on 0330 123 4448 or via email on enquiries@athenaforensics.co.uk, further details are available on our contact us page.
Our client’s confidentiality is of the utmost importance. All correspondence is treated with discretion, from initial contact to conclusion of the matter.
We are fully aware of the significance and importance of the information that they encounter and we have been accredited to ISO 9001 for 14 years.
Our premises along with our security procedures have been inspected and approved by law enforcement agencies and we do not disclose personal information to other companies or suppliers.
Our team are all security cleared and we offer non-disclosure agreements if required.
Our premises along with our security procedures have been inspected and approved by law enforcement agencies.
Athena Forensics do not disclose personal information to other companies or suppliers.
