Skip to main content
Cloud services

I have been given material involving a cloud service

Identify the service, account, object and stable identifiers before treating the visible file as the whole record. Permissions, versions, access events and synchronised devices may each explain part of its history.

Investigate now

Start with what needs doing now

Use this route when cloud material may change, be deleted or remain available through several accounts, sessions and devices.

Start the investigationWork through cloud-service evidence

Move from visible files to stable objects, permissions, versions, access records, synchronised devices and a defensible suspect.

Reference CLD-000Preserve provider dataWhen should I request preservation?

Identify the account, object, period and records at risk before provider retention or user action changes what remains.

Reference CLD-098SpeedCould provider records disappear quickly?

Recognise short retention, deletion and changing access while useful provider records may still be obtainable.

Reference CLD-097
Learn

Understand the evidence and the offender method

Use this route to understand cloud objects and their histories, then see those same functions used inside a separate offender operation.

Foundation explanationWhat can cloud storage actually show?

Understand objects, accounts, permissions, versions and service events without overstating personal attribution.

Reference CLD-001Separate offender exampleDodgy Dave puts illegal waste disposal in the shared calendar

Follow a separate illegal-waste operation through shared folders, version history, synchronisation and participant activity.

Reference CLD-175
Common questions

Go directly to the issue you need to resolve

Shared accessWhat is a shared folder?

Identify owners, members, permissions and the actions available to each.

Reference CLD-061HistoryWhat is file-version history?

Use earlier versions and save events to understand how an object changed.

Reference CLD-069Multiple devicesCan a cloud account be accessed from several devices?

Separate account activity from the particular session and device involved.

Reference CLD-012AttributionWhat should corroborate cloud-file attribution?

Test account events against devices, communications and surrounding conduct.

Reference CLD-084
Browse every Cloud services guidance page The complete reference library remains available when you need a narrower question.