Documents, photos, email, chats, calendars: less and less data lives only on devices. It sits on servers run by third parties, often in other countries, accessible from anywhere with the right credentials. Cloud forensics is about acquiring this data properly. It has rules of its own, because you cannot "seize" a major provider's server or make a bit-for-bit copy of it.
What changes compared with device analysis
- There is no physical medium to acquire: you work through the interfaces the service provides.
- Data changes constantly: synchronisations, sharing, edits by other users.
- Access depends on credentials and on the account's permissions, as well as on the service's terms.
- The provider keeps data the user does not see, such as detailed logs, accessible only through formal requests.
- Servers may be located in different countries, with different rules on data access.
Available sources
Official data export
Most major services offer a function to download a copy of your data, often as a compressed archive with files in standard formats. It is the cleanest route for the account holder, because the data is produced by the provider itself in a documented structure. Note when it was requested and when it was downloaded, and calculate the hash of the archive received.
Activity logs
Many services show the user or administrator the sign-in history, linked devices, sharing and file changes. In business editions, the admin console offers very detailed audit logs: who opened, downloaded, shared or deleted a document, from which address and when.
Version history
Storage and collaborative writing services often keep earlier versions of files. This lets you see how a document changed over time, who made each change and sometimes recover deleted content.
Trash and retention
Deleted files often stay in a trash folder for a period set by the service. In business editions there may be retention policies that keep data even after the user deletes it.
Traces on devices
Sync apps leave local databases on computers and phones with the list of files, their identifiers and sync dates. Even when the account is not accessible, these traces can show which files existed and when they were changed.
How to proceed correctly
- Check your standing: access only your own accounts, your organisation's with the administrator's authorisation, or with the holder's consent. Accessing someone else's account without authorisation is unlawful, even if you know the password.
- Document the environment: device, browser, connection, reference time.
- Prefer official exports to manual copies.
- Export activity logs before retention periods expire.
- Change nothing: avoid moving, renaming or opening files for editing, because actions are logged and can alter histories and dates.
- Record a screen video during the most significant operations, to show what was visible in the account.
- Calculate hashes of everything you download.
The provider's role
Some information is held only by the provider: login IP addresses over long periods, account registration data, content already deleted and no longer visible to the user. Obtaining it requires formal requests through judicial channels or, for personal data about you, exercising the rights granted by the GDPR, such as the right of access under Article 15. This can take a long time, and meanwhile the data risks being deleted: that is why many providers have urgent preservation procedures at the request of the authorities.
Example: a shared document altered
In a company, a shared cloud spreadsheet with prices turns out to have been altered. The administrator exports the audit log, which shows who opened the file in the preceding days. The version history reveals the change, its author and the exact time. The account's sign-in log shows that on that day the user had connected from a device never used before. The picture suggests an account compromise rather than a deliberate action by the user, a hypothesis that can be tested with further checks.
In short
- In the cloud you do not acquire a drive, but data through the service's interfaces.
- Official exports, activity logs and version history are the main sources.
- Access only accounts you are entitled to access.
- Actions in the account are logged: observe without changing.
- Some data is held only by the provider and needs prompt formal requests.