Cloud Evidence Is Not Just Files

CLOUDEVIDENCEBEYONDFILES · AGUIDEFORUKLAWYERS Cloud Evidence Is Not Just Files Versions, Logs, Permissions, Sharing Links, Deleted Objects and Admin Records: the Seven Layers Around Every Cloud Document COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the estate around the document 03 The seven layers, named 04 What each layer proves that files cannot 05 Scoping and requesting the layers, platform-neutrally 06 Collecting the layers: routes, fidelity, integrity 07 Correlation: turning layers into findings 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary THEHEADLINEPOINT : INCLOUDPLATFORMSTHEFILEISONELAYEROFSEVEN , AND THEOTHERSIXAREUSUALLYTHECASE § 0 2 · FIRSTPRINCIPLES The problem in plain English: the estate around the document § 0 3 · THEMAP The seven layers, named LAYER WHAT IT IS · WHERE THE BLOCK MET IT 1 · Versions / revisions Per-save series (SharePoint/OneDrive, guide 54-55) or per-edit streams (Google Docs, 3 · Permissions The computed possibility map with inheritance and group resolution: guide 55's discipline: 4 · Sharing links / external Link types, audiences, expiries, first-access events: guide 54's leak machinery: the 5 · Deletion / recycle records Staged bins, deletion metadata, restore events: guides 53-55's marches: the acts that 6 · Configuration / settings Retention rules, history toggles, sharing policies, version limits, with change dates: guides 7 · Admin / operations Role use, account lifecycle, hold/search/export operations: guides 51, 57 and 59's § 0 4 · THEPROOFS What each layer proves that files cannot § 0 5 · ASKINGPROPERLY Scoping and requesting the layers, platform-neutrally § 0 6 · GETTINGTHELAYERSOUT Collecting the layers: routes, fidelity, integrity § 0 7 · THEMETHOD Correlation: turning layers into findings § 0 8 · THEWIDERMAP Source architecture: where else the evidence lives LAYER EXTENDED PLATFORM DEVICE COUNTERPARTS / BACKUP DELETED / (PRIMARY) SIDE RECIPIENTS LAYER RECOVERABLE SIEM / LOGS 1 · Versions Y: series via Shadow n/a As-shared Generational Pruning/trimming 2 · Events Y, window- Local Y: longer Their event layer Backup's Windows 3 · Now-state + n/a Change Membership Point-in-time Reconstructable 4 · Sharing States + use Browser/ Access The recipients States in Varies 5 · Deletions Recycle Mirror Deletion n/a Bracketing Acts outlive 6 · Settings Current + n/a Config- n/a Historic The conduct 7 · Y: the Admin Where n/a n/a Window-bound; § 0 9 · INTHEWILD Worked examples EXAMPLE1 · THEPRODUCTIONTHATWASTECHNICALLYCOMPLETE EXAMPLE2 · THELEAKWITHAFOUR - LAYERSIGNATURE EXAMPLE3 · THELAYERSTHATCLEAREDTHEESTATE § 1 0 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 1 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your eDiscovery / forensic provider SUGGESTEDWORDING · L AY ERSCHEDULECLAUSEFORTHEDISCLOSURE SPECIFIC AT ION § 1 2 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The layers checklist Red flags When to involve a digital forensic expert § 1 3 · COMMONQUESTIONS Frequently asked questions Isn't this just metadata by another name? Which layers should a standard commercial dispute actually collect? The opponent says their platform "doesn't keep that". How do we test it? Can layers be fabricated or edited the way documents can? How does this model apply to platforms outside Microsoft and Google? What is the single highest-value habit this guide recommends? § 1 4 · REFERENCE Glossary Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY