How should I describe the limits of cloud evidence?¶

Describe the limits of cloud evidence by separating what the record shows from what must still be inferred.

Evidential caution: that technical detail automatically makes the conclusion strong.

What this means¶

A cloud record may show that an account, session, application or device identifier was associated with an event.

State the account, session, device, application, IP address, resource and time recorded.

The account may be shared or compromised. The session may be stolen. The device may be shared or remotely accessed. The application may act automatically. The IP address identifies a connection, not a person.

Also explain gaps in logging, retention, export scope and provider interpretation.

Where several records support the same inference, explain how they corroborate one another.

Where reports use visual dashboards or provider labels, preserve the underlying record and definition. A polished display can make a weak or ambiguous event appear more certain than it is.

What to check or do next¶

• Start with the provider’s own event type and definition.

Evidential limits¶

It may not prove who was physically present, who controlled the account, whether the activity was intentional or whether the person understood the content.

Then identify the limitations.

Do not hide uncertainty inside vague phrases such as “the system shows”. Name the system and the exact record.

Where alternative explanations remain, state them and explain whether the wider evidence supports or weakens them.

Use proportionate language such as consistent with, supports, indicates or cannot determine.