What is a synced folder?¶
A synced folder is a device folder connected to a cloud-storage service so that changes can be copied between the device and the cloud.
Files added, edited, renamed or deleted in the folder may be reflected online and on other connected devices.
What this means in practice¶
A file may arrive automatically from another device, another user, a shared folder or an application. The sync client may also download files in the background.
Likewise, deleting a file locally may remove it from the cloud and other devices, depending on the service and settings.
Investigators should identify the cloud account, folder path, synchronisation application, connected devices and whether the folder was personal or shared.
Also consider whether the user changed the sync settings, disconnected the account or moved files outside the folder.
The synced folder is both a device location and part of a wider cloud process. Evidence from the provider may be needed to understand its history.
What this may show¶
A synced folder can contain full local files, placeholders or a mixture of both. Some files may be available offline while others download only when opened.
What this does not show on its own¶
The dangerous assumption is that every file in the folder was deliberately placed there by the device user.
Do not interpret local creation times without context. They may show when the sync client created the local copy rather than when the original file was made.
What to do next¶
Check sync logs, file identifiers, timestamps, conflict copies, failed uploads and deleted-item records.
Key takeaway
A synced folder automatically propagates file activity between sources, so identify the originating event before treating local changes as deliberate user actions.