Question 1

Isn't this just metadata by another name?

Accepted Answer

Broader and more organised: "metadata" usually means fields on files (layer zero's own properties); the layer model covers the platform's separate record systems: series, events, states, histories, operations: most of which are not on or in the file at all and are missed precisely because they are not. Naming seven layers gives requests, schedules and reports a fixed structure that "please include metadata" never achieved.

Question 2

Which layers should a standard commercial dispute actually collect?

Accepted Answer

By default: layer 2 exported estate-wide in week one (it expires; it is cheap); layers 5-6 wherever deletion or "routine" is in issue; layer 1 as series for the documents the case turns on; layers 3-4 where access or audience is disputed; layer 7 where process or conduct is. The schedule scales with the issues: the discipline is deciding per population, on the record, rather than defaulting to zero.

Question 3

The opponent says their platform "doesn't keep that". How do we test it?

Accepted Answer

Platform-neutral request first (§5's wording), then the documentation: every major platform's layer capabilities are publicly documented, and "doesn't keep" usually means "didn't look", "didn't license" or "let it expire": three different answers with three different consequences. Ask which, in terms; request the settings and operations layers that would show it; and remember that a lapsed window after a preservation letter is not a technical answer but a conduct one.

Question 4

Can layers be fabricated or edited the way documents can?

Accepted Answer

Far less readily: platform-maintained series, events and operations records are not user-editable, which is much of their weight: the realistic vulnerabilities are at export (curation, scope) and interpretation: met by documented queries, retained self-describing exports, verification patterns and grain honesty. In practice the layers are where fabrication of documents goes to die, not a new place for it to live: Example 1's version series being the standing illustration.

Question 5

How does this model apply to platforms outside Microsoft and Google?

Accepted Answer

Directly: it is the interview you conduct with any SaaS estate: does it version, does it log, how are permissions computed, what are the sharing mechanisms, what survives deletion and for how long, what settings histories exist, what does the admin layer record: seven questions that scope Dropbox, Slack, Salesforce or a bespoke system in an after no on. The SaaS guides ahead (112-114) are this interview, conducted platform by platform.

Question 6

What is the single highest-value habit this guide recommends?

Accepted Answer

The week-one layer export: events and operations, full window, hashed and shelved, every cloud matter, before anyone knows whether they will matter: guide 57's instruction generalised to the whole estate. It is cheap, it is quick, it expires if skipped, and Examples 1-3 all rest on someone having done it: or on the other side having not. cflab. u k · e-disc ove r y. u k ©2026 Computer Forensics Lab Ltd ·cflab.uk ·e-discovery.uk ·info@cflab.uk ·+44 (0)20 7164 6915 Page 15 of 17

Cloud Evidence Is Not Just Files