Question 1

The data went to a personal cloud account. Can we even prove it?

Accepted Answer

Yes, and usually well: the corporate machine's sync database or browser artefacts name the files and the account (§4), the platform audit log records the downloads or shares (§5), the network bounds the volume, and the destination account: reached through process: holds the material itself (§6). Example 1 was proven at both ends to the minute. The cloud feels elusive and is in fact doubly-recorded.

Question 2

The employee just shared a folder rather than downloading anything. Is that exfiltration?

Accepted Answer

Squarely: sharing corporate content to a personal or external address, or creating a link and taking it away, moves the data to the employee's control without a d own load or a USB trace (§3, Example 2): and it is logged as a sharing event with the destination in the platform audit trail, which is why that log is exported first when downloads and USBs come up empty.

Question 3

Can we get into the employee's personal cloud account?

Accepted Answer

Through process, not self-help: a preservation letter and undertakings first, then delivery-up and imaging orders, commonly via an independent examiner who reports only on your material and protects the employee's private data (§6, guide 97 §7): the account holds both the manifest and the files. Where the holder will not cooperate, the provider's records are reached by disclosure. Plan the route early; the account can be emptied in minutes.

Question 4

The employee had a sanctioned personal cloud for home-working. Does that defeat the claim?

Accepted Answer

Only for what it sanctioned: the innocent-explanation pass (§7, Example 3) separates policy-permitted sync of the employee's working folder from unsanctioned transfers outside it, and the genuine exfiltration usually stands out clearly against the baseline. Running the pass first protects both sides: it narrows an over-broad claim to what will survive, and clears what was legitimate.

Question 5

How fast do we need to move?

Accepted Answer

Same-day for preservation of the near-end evidence and the destination account: audit logs expire, the personal account can be emptied, and springboard relief dies of delay (guide 97 §7): Example 1's account still held everything because the letter reached it in the first week. The manifest can be built afterwards; the preservation cannot be redone.

Question 6

Does the employer have its own obligations if client personal data left?

Accepted Answer

Yes: a transfer of client personal data to an uncontrolled personal account is a personal-data breach with UK GDPR not if i c at i on questions on the ICO's clock (guide 99 §6): assessed from the manifest's sensitivity classification (§7) as the investigation proceeds, not after. The exfiltration investigation and the breach assessment run together. cflab. u k · e-disc ove r y. u k ©2026 Computer Forensics Lab Ltd ·cflab.uk ·e-discovery.uk ·info@cflab.uk ·+44 (0)20 7164 6915 Page 15 of 17

Data Exfiltration To Cloud Storage