How do I identify whether cloud data was shared externally?¶

Identify external sharing by examining sharing links, permissions, guest users, external domains, download records and audit events.

Evidential caution: that a file remaining inside the cloud service was never disclosed outside the organisation.

What this means¶

A user may share a direct link, invite an external account, make the item public, download and resend it or use a connected application.

Review access logs to see whether the link or resource was actually used.

Equally, the absence of an access record may reflect limited logging or expired retention.

Where guest access is involved, preserve both the home identity and the guest identity in the hosting tenant.

Also establish whether permissions changed over time. A file may be private now but externally accessible during the relevant period.

What to check or do next¶

• Investigators should identify the resource ID, owner, sharing setting, recipients, link type, creation time, expiry and whether authentication was required.
• Check whether the link allowed viewing, editing or download.
• Check for copies, exports, email attachments, messaging platforms and synchronised folders.

Evidential limits¶

Do not assume that creating a link proves the recipient opened it.

Where a shared link was later disabled, preserve the original link identifier and audit history. The current inability to open it does not remove its earlier evidential significance.

Where access was granted through a group, folder or inherited permission, preserve the full permission chain. The named recipient may not appear directly on the item even though they could access it.