What is a shared folder?¶
A shared folder is a cloud folder that several accounts or users are permitted to access.
Depending on the permissions, users may be able to view, upload, edit, download, move, delete or share its contents.
What this means in practice¶
One user may create the folder. Another may upload a file. A third may receive access later. The content may also be added automatically by an application or synced device.
Permissions can differ between users. Some may have view-only access while others can edit or manage sharing.
The provider may record folder ownership, membership, invitations, permission changes and file activity. But the detail and retention vary.
Investigators should identify the folder owner, tenant or workspace, users and groups with access, permissions at the relevant time and whether access was inherited from a parent folder.
Use precise language. Distinguish the folder owner, file owner, uploader, editor and users with access.
What this does not show on its own¶
The dangerous assumption is that every file in a shared folder belongs to, or was created by, every person who can access it.
A shared folder can also create local copies on several devices through synchronisation. Deleting the cloud file may not remove every downloaded copy.
What to do next¶
Check when each user was added or removed. Current permissions may not show who had access when the event occurred.
Do not assume that access proves knowledge. A user may have been granted access without opening the folder. Equally, file-access records may support later awareness or activity.
Key takeaway
A shared folder separates access, ownership and action, so establish who had which permission at the relevant time and who actually handled each file.