How do I identify which cloud service is involved?¶

Identify the cloud service by examining the account, application, domain, file path, browser history, email notifications and provider branding linked to the activity.

Evidential caution: that the visible app name always identifies the actual provider holding the evidence.

What this means¶

A user may access one service through another application, single sign-on provider, mobile app or business platform.

A file-sharing link may redirect through a security gateway. A company-branded portal may sit on top of a larger cloud provider.

Where a URL is available, preserve it exactly without opening it unnecessarily.

The user may authenticate through one service while the files, messages or logs sit in another.

Also distinguish personal and organisational versions of the same product. Retention, administrator access and available logging may differ.

Where the service is embedded inside another platform, identify both the user-facing product and the underlying provider. Each may hold different records and respond through a different process.

What to check or do next¶

• Investigators should record the full domain, application name, client ID, account identifier and any tenant or organisation details.
• Check device applications, browser history, downloaded files, email alerts, password-manager entries and synchronisation folders.
• Look for provider-specific resource IDs, tenant IDs and file structures.

Evidential limits¶

Do not assume the identity provider and data provider are the same organisation.

Where uncertainty remains, use provider documentation or specialist support to identify the service before submitting requests.