What is a file owner in a cloud service?¶
A file owner is the account or organisation that the cloud service records as having primary control over the file.
Ownership may determine who can manage sharing, transfer control, delete the file or change permissions.
What this means in practice¶
Ownership can arise in several ways. The user may create the file, upload it, receive ownership from somebody else or inherit it through an organisational workspace.
In some services, the organisation or tenant owns the file even though an individual account created it. In others, ownership may remain personal until transferred.
A file owner may never have opened or edited the content. Another user may have created the material and then transferred ownership. An administrator may also change ownership after a user leaves.
Investigators should identify the current owner, previous owners where available, the tenant or workspace, transfer events and the permissions held by other users.
The owner may control the file’s current settings while another person supplied the content. A shared account or application may also be recorded as the owner.
Where ownership changed, establish when and why. Organisational offboarding, migration and automated processes may explain a transfer without suggesting misconduct.
Use version history, upload records, sharing logs and device evidence to examine creation and use separately from ownership.
What this does not show on its own¶
The dangerous assumption is that the owner must have created the content.
What to do next¶
Do not confuse file ownership with authorship, possession or knowledge.
Key takeaway
Cloud file ownership shows recorded control over the file, not necessarily who created, edited, read or understood its contents.