What is the final investigator checklist for cloud evidence?¶

The final investigator checklist for cloud evidence is a disciplined sequence of identification, preservation, collection, interpretation and review.

Evidential caution: that cloud evidence is simply an account record obtained from a provider.

What this means¶

First, identify the service, product, tenant, account, application, resource and likely evidence holders.

Second, define the investigative question and the decision the evidence could change.

Third, assess volatility.

Fourth, separate device evidence, organisational evidence and provider evidence.

Fifth, collect the records with stable identifiers, original timestamps, time zones, field definitions, filters and source information.

Sixth, distinguish manual activity from automation, service accounts, synchronisation and third-party applications.

Seventh, separate account attribution, session attribution, device attribution and personal attribution.

Ninth, document live-system interaction, containment, permission changes and anything that may have altered the environment.

Tenth, review completeness, proportionality, gaps and stop conditions.

The checklist should be revisited as the enquiry develops. New records may change the likely account, session, device or person and require earlier assumptions to be tested again.

Before closing the enquiry, confirm that preservation requests, provider responses, tenant exports, device examination and specialist actions have been reconciled into one timeline and decision record.

What to check or do next¶

• Preserve short-lived login, session, token, audit, deleted-item and security records where relevant and proportionate.
• Use specialist support where the system is live, volatile, complex or attribution-heavy.

Evidential limits¶

Eighth, test alternative explanations including sharing, compromise, remote access and several active sessions.