Where is cloud data actually stored?¶

Cloud data is stored on physical systems operated by or for a provider. Those systems may be spread across several data centres, regions and service partners, while copies or fragments also exist on users’ devices.

The cloud still uses real computers¶

“In the cloud” describes how the service is delivered, not an absence of physical storage. Providers use large groups of servers and storage systems, usually within controlled data centres.

The user normally sees an account, folder or application rather than a particular disk. The provider’s systems decide where the data is placed, replicated and backed up.

When Dave uploads one document, he sees one filename. The provider may store the active object in one system, resilience or version material elsewhere and synchronised copies on Dave's devices.

Think of a bank account rather than a labelled cash box. The customer sees a balance and transactions, while the institution manages the underlying systems needed to provide that service.

There may be several relevant copies¶

A single file may exist as:

• the provider’s active copy;
• replicated or resilient copies in other systems;
• previous versions or deleted-item records;
• cached or synchronised copies on phones and computers;
• copies shared into another user’s account;
• exported, downloaded or backed-up versions.

These copies may not be identical or retained for the same period. A deleted local file may remain in the provider account, while a deleted cloud item may still exist on an offline device.

Geography is an account and legal question¶

The customer’s location does not reliably show where the provider processes or stores the data. A provider may assign an account to a region, move data within that region or use specialist subcontractors.

Investigators should identify the provider, service, customer relationship and relevant time rather than attempting to locate an individual server from an app screen. Provider documentation and formal returns can clarify the applicable entity, region and available records.

Ask for the evidence, not the disk¶

The useful question is usually whether the provider can preserve or produce a defined account, file, version or event. Exact account identifiers, file links and times are more valuable than a broad request to identify “where the cloud is”.