When should I stop pursuing cloud evidence?¶

Stop when further cloud work is unlikely to change a real investigative, attribution, safeguarding or evidential decision, or when its remaining value no longer justifies delay, cost and intrusion. The purpose is to resolve a question, not to exhaust every provider that might hold data.

Review what remains achievable¶

The point may be reached when relevant records have expired, the account cannot be identified reliably, the available fields cannot distinguish competing explanations, or stronger evidence answers the question more directly. Provider delay and specialist effort should be assessed against the likely result, not treated as reasons in isolation.

Before closing a volatile line, consider whether targeted preservation is justified while the final acquisition decision is made. If records have already expired, note whether earlier preservation was realistically available and capture any learning without changing the present evidential position.

Make closure a reasoned decision¶

Record what was sought, obtained and unavailable; the limitations of the available material; alternatives considered; and why further work would not be proportionate or decision-relevant. Set out any circumstance that would justify reopening the line if new information emerges and records remain available.

Stopping does not mean the original enquiry was mistaken. It shows that its value has been reassessed against current evidence and priorities.