What does synchronisation mean in cloud storage?¶
Synchronisation is the automated process that keeps files or other data aligned between a cloud service and one or more devices.
A change in one location may be copied to the others.
What this means in practice¶
A file created on one device may appear automatically on another. A deletion may be repeated across devices. A renamed folder may update throughout the account.
Synchronisation may happen immediately, after a delay or only when the device reconnects. Conflicts, failed uploads and offline edits can create several versions.
The cloud service may record upload, modification or synchronisation events. The device may record local file creation, application activity and sync-client logs.
For investigators, identify the synchronisation account, application, folder settings, connected devices and whether the device was online at the relevant time.
What this may show¶
Those timestamps may describe different stages of the same process. A local creation time may reflect when the file downloaded, not when the user originally created it.
What this does not show on its own¶
The dangerous assumption is that every synchronised event represents a user manually moving or editing a file.
Synchronisation can also be selective. Some folders may remain online only. Some files may be marked for offline access. Another device may not be configured to receive the folder at all.
What to do next¶
Ask whether the event was user initiated or automatically propagated from another source.
Do not assume that finding the file in a synced folder proves the user opened or knew about it. The sync client may have placed it there automatically.
Key takeaway
Synchronisation can create, alter or delete local copies automatically, so trace the originating event and distinguish user action from the system’s later propagation.