Does “in the cloud” mean the data is stored in one place?¶

No. A cloud service presents data as one accessible resource, but the provider may distribute storage, processing, backups and logs across several systems and locations.

One folder can hide a complicated service¶

Dave may open one app and see one folder. Behind that simple view, the provider may keep active data in one region, resilience copies elsewhere and account logs in another system.

The service is like a library catalogue: it gives the user one coherent way to find material even though the books, archive and lending records may be managed in different places.

Providers distribute data to maintain availability, improve performance and protect against equipment failure. Larger services may also separate file content from metadata such as filenames, sharing permissions and access events.

Copies can leave the provider¶

Cloud data may also be present on:

• synchronised phones, tablets and computers;
• shared recipients’ accounts;
• downloaded devices or removable media;
• backup services;
• connected applications given account access.

This matters when an item is changed or deleted. The provider’s active copy, a previous version and a recipient’s downloaded copy may tell different parts of the history.

“Where” has several meanings¶

An investigation may need to distinguish:

• where the customer or user was located;
• which legal entity supplied the service;
• which account region was selected;
• where provider systems processed the data;
• where accessible copies now exist.

These cannot be answered reliably from the cloud brand or the user’s address alone. Where cloud data is stored explains the physical and service layers.

Frame requests around the event¶

Preservation and production requests should identify the account, file or event and relevant period. The provider can then apply its system architecture and retention rules without the investigator having to name a particular data centre.