Cloud Services · CLD-013

What does a cloud record actually prove?¶

A cloud record proves that a particular system recorded a particular event or state.

It does not automatically prove who caused it, why it happened or whether the record is complete.

What this means in practice¶

Also consider what is missing. The absence of an event may reflect disabled logging, limited retention, a different access route or an unsupported activity rather than proof that nothing happened.

What this may show¶

A login record may show that an account authenticated from a recorded IP address at a particular time. A file record may show that the service attributed an upload, edit, view or deletion to an account or application. An administrator log may show that a setting changed.

The evidential value depends on how the service generates the record, what identifiers it uses, its time settings, retention, logging configuration and known limitations.

Corroborate important events with other sources. Device evidence, additional logs, communications, business records, CCTV and witness accounts may help establish the person, purpose and context.

What this does not show on its own¶

The dangerous assumption is that the wording of the event is a complete description of human behaviour.

A “file viewed” event may mean that the service delivered a preview. It may not prove the user read or understood the content. A “download” event may show that data was transferred, not that the file was opened. A successful login may involve a remembered session, linked application or stolen token rather than the user entering a password.

What to do next¶

Ask which system produced the record. Is it a provider audit log, user-interface history, security alert, administrator report or somebody’s summary? Alerts and summaries may be derived from underlying events and may apply rules or assumptions that need to be understood.