What is the difference between cloud data and data stored on a device?¶

Cloud data is held within a provider-managed service and reached through an account or link. Device data is held locally on a phone, computer or other equipment. Modern applications often use both at the same time.

Synchronisation connects the two¶

A file shown on a laptop may be fully downloaded, partly cached or represented only by a placeholder that retrieves the content when opened. Editing it may update the provider copy and then synchronise the change to other devices.

If Dave edits a synchronised file on his laptop, the application may upload the change to the provider. The service can then send that version to his phone without Dave deliberately transferring it a second time.

An app icon or filename therefore does not prove that the full content is locally available. Equally, a device may retain a cached copy after the user believes the cloud item has been removed.

The evidence sources answer different questions¶

The provider may hold:

• account creation and recovery details;
• server-side files and versions;
• sharing settings and links;
• login, access and change events;
• deleted-item or retention information.

The device may hold:

• downloaded or cached content;
• local timestamps and application databases;
• authenticated sessions or access tokens;
• synchronisation records;
• evidence connecting activity to a particular user and device.

Provider records can show that an account performed an event. Device evidence may help establish who had access to that account and whether the relevant content was present locally.

Deletion may affect each copy differently¶

Deleting a file on a synchronised device may remove it from the provider and other connected devices. Disconnecting or switching off a device may leave its local copy unchanged. Retention, recycle-bin and version features also vary between services.

Avoid experimenting with a live account or opening files unnecessarily, because normal interaction may change access times, synchronisation state or remote data. Seek appropriate specialist support where preservation or remote-change risk is significant.

Examine the relationship¶

Record the account, application, device state and connectivity. The useful conclusion is not simply “the file was in the cloud” but how the device, account and provider records relate at the relevant time.