I have been given evidence involving a cloud service. What happens next?¶

The two reported filenames sit inside folder F-2804 as objects OBJ-4407 and OBJ-4412, each with a version history.

Preserve Leila's original screenshots, messages and security notification, but do not treat a download as the whole cloud record. Cloud metadata can differ from device metadata, and a locally saved file may acquire a new created date without changing the provider's object history.

Record the account, folder, object, version and share identifiers. Consider cloud preservation promptly where deletion or changing permissions may affect what remains available.

Version history shows C-77503 opening the relocation plan and changing the budget within the period described by Leila.

File-version history records the sequence of changes and the service account involved. It does not prove the account holder authored every alteration. Here, the unique quoted sentence and close timing are strong corroboration because the cloud and messaging services record different parts of the same conduct.

Marcus's account had been granted editor access during the relationship; later events show that permission being used and extended to another account.

A shared folder can allow viewing, editing, downloading or further sharing depending on the permission. The fact that Leila originally granted access explains how the account could reach the files; it does not answer whether later use formed part of coercive or controlling conduct.

A public or forwarded link can reach people not named in the visible folder. Why shared links can travel explains why provider access events and the permission history matter more than assumptions about who Leila intended to include.

Account C-77503 is registered to Marcus, and the relevant session used his recurring application identifier from a connection associated with his address.

The customer record gives a direct line of enquiry, not final attribution. A successful cloud login establishes that the service accepted the credentials or authentication presented; it does not see the person holding the device.

Here, session SES-6B81 uses application identifier APP-2F71, previously associated with Marcus's account over several months. The source address is allocated to the service at his address at the relevant time. Those records substantially strengthen the account connection while leaving possession and control to be tested.

A tablet recovered from Marcus contains a synchronised copy of folder F-2804, the relevant application identifier and local versions matching the provider records.

Synchronisation can place cloud material onto a device automatically, so the existence of a local copy alone does not prove it was deliberately opened. In this case the tablet also records the active session, recent access to both objects and the message sent minutes later quoting text unique to version V-12.

The provider's folder, version, permission and session records now align with Leila's messages and the recovered device. This is a strong circumstantial route to Marcus: independent sources connect him to the account, device, private information, alteration and communication. The enquiry can be positive about that strength while still testing whether somebody else used the account and what Marcus says the activity meant.