When should I stop pursuing cloud evidence?¶

Stop pursuing cloud evidence when the likely evidential value no longer justifies the time, cost, intrusion or delay.

Evidential caution: that every possible cloud lead should be followed until every provider has replied.

What this means¶

A cloud line of enquiry should answer a real investigative question. If the result would not change a decision, attribution, safeguarding response or evidential assessment, the value may be limited.

Also consider whether stronger evidence is already available elsewhere.

Device evidence, communications, witness accounts or organisational records may answer the question more directly.

Where new information later changes the value, the line can be reopened if records remain available.

Where the line is stopped because records expired, identify whether earlier preservation was reasonably available. That review may improve future practice without changing the current evidential position.

What to check or do next¶

• Do not continue merely because the provider might hold additional data in theory.
• Record what was sought, what was obtained, what remains unavailable and why further action is no longer proportionate.
• Do not abandon volatile evidence without considering preservation first. It may be proportionate to preserve now and decide on acquisition later.

Evidential limits¶

Review the line where the provider confirms the relevant records have expired, the account cannot be identified reliably or the records available cannot distinguish between the competing explanations.

Stopping does not mean the original enquiry was wrong. It means the decision has been reviewed against the evidence and operational priorities.