What should I do first when cloud evidence may be relevant?¶

Start by identifying the investigative question, the cloud service involved and what evidence may be at risk of disappearing.

Evidential caution: that the first step is to obtain everything from the provider.

What this means¶

Before making requests, establish what account, tenant, application, file, session or device is actually relevant.

Could it help identify the account used, preserve recent activity, explain access, prove sharing, show deletion or link a session to a device?

Then identify the likely evidence holders.

The provider may hold account and audit records. The customer organisation may hold administrator logs, security alerts and backups. Devices may hold local copies, tokens, browser artefacts and synchronisation data.

Consider volatility immediately.

Login records, deleted items, session information and security alerts may expire quickly. Preservation may therefore be more urgent than full acquisition.

Opening links, signing in, restoring files or reconnecting devices may create new events or alter existing evidence.

Where the environment is complex, active or compromised, seek specialist support early.

Where several possible services exist, prioritise the one most likely to hold volatile records and document why. The first action should protect the most fragile and decision-relevant evidence.

Where an account is actively being used, also identify whether immediate preservation can occur without alerting the user or changing the live service. Operational planning should separate preservation, collection and containment rather than treating them as one action.

What to check or do next¶

• Ask what decision the cloud evidence could change.
• Do not interact unnecessarily with the live account.
• Record the identifiers, time zone, known accounts, date range and actions already taken.