What should I ask a cloud specialist to help me establish?¶

Ask a cloud specialist to help establish the technical meaning, source, completeness and limitations of the records.

Evidential caution: that the specialist’s role is simply to confirm the investigator’s existing theory.

What this means¶

The specialist may also help identify volatile records, appropriate preservation, additional data holders and the effect of containment actions.

Their opinion should explain the technical evidence, not decide guilt, intent or legal responsibility.

Agree the terminology before the specialist reports. Terms such as login, access, device and location can mean different things across cloud products and should not be left ambiguous.

What to check or do next¶

• Start with the investigative question and the decisions that depend on the evidence.
• Ask which systems generated the records, what each event type means and whether important logging gaps exist.
• Seek help linking authentication, sessions, tokens, applications, devices, resources and administrator actions.
• Ask whether the records distinguish user activity from automation, synchronisation, service accounts or provider processing.
• Provide the original exports, provider definitions, known identifiers and a clear timeline. Do not give only screenshots or a narrative summary if better source material exists.
• Ask whether any conclusion depends on undocumented provider behaviour, current product configuration or assumptions about retention. Those points may require separate provider or SME confirmation before operational reliance.

Evidential limits¶

Where attribution matters, ask what the evidence supports and what it cannot establish without device or wider corroboration.

Ask the specialist to state assumptions, uncertainties and alternative explanations.