Does the absence of a cloud log entry prove the activity did not happen?¶

No. The absence of a cloud log entry does not prove that the activity did not happen.

Evidential caution: that cloud systems record every action and retain every record.

What this means¶

The activity may also appear in another system, such as authentication, API, application, administrator or device logs.

Some provider interfaces show only recent activity or selected high-level events.

Where the absence is important, seek specialist or provider confirmation about expected logging behaviour.

Absence becomes more informative only where the system was expected to log the event, logging was active, retention covered the period and the correct records were examined.

What to check or do next¶

• Investigators should establish whether the action would normally create a record in that service and configuration.
• Check the subscription level, logging settings, retention period, account permissions and export filters.
• Look for related evidence. A missing download event may still be supported by a local file, browser artefact, application record or later sharing activity.

Evidential limits¶

The event may not have been logged, the relevant logging may have been disabled, the record may have expired or the export may exclude that event category.

Equally, do not assume that the missing record must have existed and been deleted. There may never have been a log entry.

Use careful language. State that no relevant record was found in the material examined and explain the scope and limitations of that material.