What is the difference between viewing, editing, downloading and sharing a file?¶
Viewing, editing, downloading and sharing are different cloud events and should not be treated as interchangeable.
Viewing means the service displayed or delivered the file or a preview. Editing means content or metadata changed. Downloading means data was transferred to a device or application. Sharing means access was granted or a link was created.
What this means in practice¶
A view may involve a preview or automated process. A download may complete without the file being opened. An edit may be automatic, such as a format conversion or synchronisation change. Sharing may occur through a group or inherited permission rather than a deliberate link sent to one person.
The provider’s terminology matters. Different services may use the same word for different technical events.
Investigators should identify how the service defines each event and what underlying action creates the log entry.
Use device and wider evidence to establish whether the file was opened locally, read, retained or sent onwards.
What this may show¶
A single sequence can contain several events. Opening a file in a browser may generate a view, temporary download and autosave. Editing may create a new version. Sharing may occur before or after access.
What this does not show on its own¶
The dangerous assumption is that any one of these events proves the user fully opened, read, understood or retained the file.
Do not overstate the human behaviour. Say that the service recorded a view, edit, download or share event and explain what that event means in that system.
What to do next¶
Compare the account, session, application, device, IP address, file identifier and time.
Key takeaway
Treat view, edit, download and share as separate system events, and establish what each event means before drawing conclusions about user behaviour.