Page 1

ONEDRIVE EVIDENCE · A GUIDE FOR UK LAWYERS One Drive Evidence Sync, Versions, Deleted Files and Sharing: the Personal Drive That Is Never Only in One Place COMPUTER FORENSICS LAB

§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM EXFILTRATION ANALYSIS CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION

§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: one drive, two truths 03 Cloud-side anatomy: versions, recycle stages, sharing states 04 Device-side anatomy: the sync client's confessions 05 Collection: both halves, with the joins planned 06 Deletion, the leaver clock and recovery 07 Exfiltration patterns and how they prove 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist

§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: ONEDRIVEISTWOSOURCESWEARINGONENAME, AND THE CASE USUALLYLIVESINTHEIRDIFFERENCES

§ 02 · FIRST PRINCIPLES The problem in plain English: one drive, two truths

§ 03 · THE CLOUD HALF Cloud-side anatomy: versions, recycle stages, sharing states