What should I check when cloud data has been synchronised across devices?¶

When cloud data has been synchronised across devices, identify which device created, changed, downloaded or deleted each version and when the synchronisation occurred.

Evidential caution: that every device holds the same data and timestamps.

What this means¶

A cloud service may create local copies, previews, placeholders, caches and conflict files.

One device may remain offline and later upload an older or conflicting version.

A deletion on one device may synchronise across others, but local copies may survive in recycle bins, backups or disconnected storage.

Where several devices are linked to one account, identify the session or device record associated with each change.

Avoid reconnecting an isolated device without considering whether synchronisation could alter or delete evidence.

Where conflict copies exist, preserve each separately. The differences may identify which device was offline, which version was edited and how the provider resolved the collision.

Where synchronisation was incomplete, record queued, failed or paused operations. Those records may explain why one device retained content or why a cloud change did not reach every endpoint.

What to check or do next¶

• Investigators should record the account, device, sync application, folder path, file ID, version ID, local timestamps and provider timestamps.
• Check whether the device was online at the relevant time and whether synchronisation completed successfully.
• Do not treat the local modified time as automatically equal to the cloud event time.
• Compare device logs, application databases, file-system artefacts and provider audit records.