This guide explains how to determine who accessed or downloaded a confidential document across cloud platforms, file servers, and endpoints.
Guide · 17 pages · 23 min read · Published 2026-08-31
Designed for UK legal practitioners investigating data breaches, corporate leaks, and unauthorised disclosures, this publication addresses the technical and evidentiary challenges of tracking confidential document activity across digital environments. Identifying the specific individual behind an incident is complicated by the fact that cloud platforms, on-premises file servers, document management systems, and local endpoints log account activity rather than verified human identity. The material examines evidence captured across platforms including SharePoint, OneDrive, Google Drive, and SaaS applications, detailing what individual actions prove regarding whether a file was viewed, opened, downloaded, synced, printed, or shared. It explains the critical retention clocks that determine log survival, strategies for linking user accounts to physical persons through independent corroboration, and the wider source architecture encompassing audit logs, endpoint artefacts, and sign-in layers. Legal professionals are provided with drafting aids for access-record preservation requests, interrogatories for opponents, analysis of investigative scenarios, common technical limitations, and a practical checklist of red flags indicating when to instruct a digital forensic expert.
Read this guide on your phone, open the PDF reader with the full text, browse guides by topic or go back to the full PDF library.
17 pages · 23 min read
Understanding who accessed or downloaded a confidential document involves exam in in g access trails across cloud platforms, file servers, and end point s.
Published by Computer Forensics Lab on 2026-08-31. Original material of the practice, free to read, cite and download. The authority behind this subject is ICO guide to the UK GDPR, which you should read alongside this guide. See every guide's author and source.
Prefer a PDF that matches this page exactly? Download the current text as a PDF, generated from the current wording of the guide, including any later corrections.
DOCUMENT ACCESS EVIDENCE · A GUIDE FOR UK LAWYERS Who Accessed or Downloaded a Confidential Document Reading Access Trails Across Cloud Platforms, File Servers and Endpoints COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM ESTABLISHED 2007 · LONDON ISO 17025-ALIGNED PROCEDURES ACCESS-LOG ANALYSIS
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: access is logged, and logs are not names 03 Cloud platforms: what Share Point, One Drive, Google Drive and SaaS record 04 File servers, DMS and end point s: the on-premises and local record 05 What each record proves: view, open, d own load, sync, print and share 06 Retention, licensing and the clocks that decide survival 07 From account to person: attribution and deployment 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: FILEACCESSISRECORDEDATTHEPLATFORM, THE SERVER AND THE END POINT, EACHNAMINGANACCOUNTRATHERTHANAPERSONANDEACHONITS OWNRETENTIONCLOCK: EXPORTTHELOGSFIRST, READWHATEACHEVENTACTUALLY MEANS, THENJOINACCOUNTTOPERSONWITHINDEPENDENTCORROBORATION
§ 02 · FIRST PRINCIPLES The problem in plain English: access is logged, and logs are not names
§ 03 · THECLOUDRECORD Cloud platforms: what Share Point, One Drive, Google Drive and SaaS record
§ 04 · THEON - PREMISESANDLOCALRECORD File servers, DMS and end point s: the on-premises and local record
§ 05 · WHATEACHEVENTPROVES What each record proves: view, open, d own load, sync, print and share
§ 06 · THECLOCKS Retention, licensing and the clocks that decide survival
§ 07 · FROMACCOUNTTOPERSON From account to person: attribution and deployment 99
§ 6's clocks), and leak inquiries where the access population narrows the candidates: the finding drafted to
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives QUESTION SESSION COPY + PLATFORM END POINT PHYSICAL DELETED/ AUDIT LOG ARTEFACTS LAYER EXPIRED SIGN-IN / DOWNSTREAM LAYER RECIPIENT
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THEBOARDPAPERANDTHEFORTY - ONEACCOUNTS EXAMPLE2 · THESERVERTHATWASNEVERLISTENING EXAMPLE3 · THE ACCESS THAT WAS AP REVIEW, ANDTHEDISCIPLINARYTHATWAS WITHDRAWN
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · AC CESS - RECORDPRESER VAT I ON AND DISCLOSURE REQUEST
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The access-investigation checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions Can we find out who opened a document on Share Point? How long do access logs last? The file server has no access logs. Is the trail cold? The log says my client's account accessed the record. Is that the end of it? Can access to a document be proved after it was deleted? Someone photographed the screen. Can that be traced?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
17 pages · 25 min read
This guide assists UK lawyers in understanding data exfiltration to cloud storage.
17 pages · 23 min read
This guide for UK lawyers explains how to prove a USB drive connection through forensic analysis of the artefact stack, identifying specific devices via serials, and establishing connection timing.
Whether you are responding to a regulator, preparing for disclosure, or scoping an internal investigation, start the chain of custody with a short, confidential conversation.
