Could downloading a cloud file alter audit records?¶

Yes. Providers can record the account, session, device, network, time, file, version and chosen format, while the local system creates its own history.

Preserve the native object context¶

Record service, tenant, object ID, path, owner, version, timestamps and sharing. A download may be a converted copy that omits comments, versions, permissions and cloud features.

Consider provider preservation, native export or specialist acquisition instead of the easiest visible download button.

Attribute the download¶

If justified, use approved equipment and record account, browser, network, time, destination, format prompts and confirmations. Keep the file separate from the live-object record.

Download time is not document creation time, and investigator-created audit entries must remain identifiable.