What should I do when I encounter a live cloud session?¶

Preserve the session, account and visible page before any refresh, download, logout or navigation changes provider-held data and audit history.

Identify the remote environment¶

Record service, URL, account, tenant, workspace, role, time and device. Note whether it is live, cached, delegated, administrative, remote or virtualised.

Capture visible folders, filenames, document IDs, sharing, versions, deleted-item notices and warnings. The local device may only be an access route.

Avoid treating cloud storage as a local folder¶

Do not open, rename, move, delete or download merely to inspect. Other users and automated systems may continue editing remotely.

Seek cloud, provider or forensic support for volatile, critical or incident-related data. Record every unavoidable action separately from the original state.