What types of cloud service might appear in an investigation?¶

Cloud services do far more than store files. They can provide communications, business applications, databases, virtual servers, backups, identity systems and the infrastructure behind websites and mobile apps.

Dave may knowingly use cloud storage and an online calendar while the application itself quietly relies on a cloud database, identity service and logging platform. The user-facing product is only one part of the service chain.

User-facing services¶

Common examples include:

• file storage, photograph backup and synchronised folders;
• email, calendars and contact systems;
• document editing and workplace collaboration;
• messaging, video meetings and shared workspaces;
• password managers and device backups;
• accounting, customer-management and booking platforms.

These services often hold both content and account history. A shared document, for example, may have revisions, comments, permissions and access events as well as its visible text.

Services running behind the scenes¶

Organisations and developers may rent:

• virtual servers and hosted applications;
• databases and data-processing tools;
• website storage and content-delivery services;
• authentication and identity systems;
• logging, monitoring and security platforms;
• backup, archive and disaster-recovery services.

A victim or suspect may never see the provider’s brand. The service may appear only in a website configuration, invoice, application log or technical record.

Personal and organisational accounts differ¶

A personal storage account may have one main user and several connected devices. A business cloud environment can contain an organisation, administrators, many user accounts, service accounts and external guests.

Identify the relevant role before requesting records. The organisation may be the customer, an administrator may manage access and an individual user may perform the event under investigation.

Start from what the service did¶

Brand names and marketing terms change. Ask whether the service stored content, authenticated a user, processed data, delivered a website or recorded activity. Then identify which provider and account performed that function.

This functional approach prevents “cloud” from becoming a single vague category and helps target preservation and production work.