CLD-005 Cloud Services
What is the difference between cloud data and data stored on a device?¶
Cloud and device evidence may overlap, but they record different parts of the activity. A device may show only a preview or cached copy while the provider retains versions, sharing and access records.
Evidence and questions to consider¶
- local files, caches and application databases;
- account identifiers and browser history;
- provider versions and deleted items;
- sharing and login activity;
- administrator changes;
- whether interaction could trigger synchronisation.
Keep the sources separate¶
A provider record, customer-administrator report, application screen and device artefact may describe related activity without proving the same thing. Preserve exact identifiers, dates, times and time zones, and test shared access, delegation, automation, compromise and changing account control.
Key takeaway
Preserve and describe device evidence and provider-held cloud evidence separately.