What should I record when collecting cloud records?¶

When collecting cloud records, document the source, scope, method and context well enough for another person to understand what was obtained.

Evidential caution: that saving the file is sufficient.

What this means¶

Take screenshots of relevant settings and filters where helpful, but do not rely on screenshots instead of the export.

Where several exports are combined, keep the originals separate and document the merging process.

Where collection occurs in several stages, assign each export a clear reference and keep an acquisition log. This prevents later confusion about which file came from which source and time period.

What to check or do next¶

• Record the provider, service, tenant, account, administrator or user who performed the collection, and the authority or organisational process used.
• Capture the collection date and time, time zone, system or interface, export type, filters, date range and event categories.
• Record whether the material came from a user-facing page, administrator console, API, security platform or provider disclosure.
• Preserve the original filenames, file structure, field names and any accompanying provider definitions.
• Note the permissions held by the collector and whether the interface imposed limits or pagination.
• Record any changes caused by the collection, such as restoring a file, opening a shared link or generating a report.
• Do not rewrite provider event labels inside the source copy. Interpretation belongs in a separate working record.
• Record any software used to inspect or transform the files. Automatic date conversion, delimiter handling or character encoding can silently change the working copy.