Cloud Forensics

Cloud services have become essential to modern business and personal computing. Email, documents, backups, collaboration platforms, user activity, and other important evidence may no longer exist only on a computer or mobile device but may be stored across one or more cloud-hosted locations.

Our Cloud Forensics services help you identify, acquire, preserve, investigate, analyse, interpret, and report on digital evidence stored in cloud environments in a legally defensible manner.

Depending on the investigation and the access available, we can assist with evidence from platforms such as Microsoft 365, Exchange Online, OneDrive, SharePoint, Microsoft Teams, Google Workspace, Gmail, Google Drive, Dropbox, iCloud and other cloud-hosted services.

Where appropriate, cloud evidence can also be correlated with evidence recovered from computers, servers, mobile devices, email systems and other digital sources to establish a more complete picture of what occurred.

Below Are Some Of The Most Common Cloud Forensic Scenarios:

Data Theft And Intellectual Property Investigations

Employees and other authorised users increasingly access confidential business information through cloud platforms rather than traditional file servers.

If confidential information may have been copied, downloaded, shared, or removed, we can help investigate:

Access to confidential documents and folders.
Files downloaded from cloud storage.
Files uploaded to personal or unauthorised cloud accounts.
Sharing of files with external users.
Changes to file or folder permissions.
Creation of public or anonymous sharing links.
File modification, deletion and movement.
Synchronisation of company data to computers or mobile devices.
Relevant user, access and audit activity.

Cloud evidence is particularly important in investigations involving departing employees, intellectual property theft, or suspected unauthorised disclosure of confidential information.

Employee Misconduct And Ex-Employee Investigations

A significant amount of employee activity may occur within Microsoft 365, Google Workspace and similar cloud environments.

Depending on available information, our investigation may help establish:

Which cloud services and accounts were accessed.
When users logged into an account.
Files accessed, downloaded, modified, deleted or shared.
Documents shared outside the organisation.
Changes made to access permissions.
Use of cloud-based email and collaboration systems.
Suspicious activity shortly before resignation or termination.
Whether company information may have been transferred to an external location.

Cloud evidence can be analysed alongside the employee's computer, mobile device, email account, and other digital evidence to reconstruct an activity timeline.

Data Breach Investigations

After a suspected data breach, cloud audit and security information may provide important evidence about how an account was compromised and what the attacker did after gaining access.

Our cloud forensic investigation may include:

Reviewing login and authentication activity.
Identifying suspicious or unusual login locations.
Reviewing IP addresses associated with account access.
Examining successful and failed login attempts.
Investigating unusual account activity.
Reviewing changes to permissions or security settings.
Identifying suspicious file downloads or sharing activity.
Investigating changes to email forwarding rules.
Reviewing administrative and audit logs where available.
Establishing a timeline of potentially unauthorised activity.

When possible, this evidence can be correlated with email, computer, mobile device, firewall, server, and other forensic evidence.

Business Email Compromise

Cloud-hosted email systems are frequently targeted in Business Email Compromise and account takeover attacks.

A forensic investigation can help establish:

Whether an email account was accessed without authorisation.
When the compromise may have occurred.
IP addresses and login information associated with suspicious activity.
Whether email forwarding or inbox rules were created.
Whether emails were deleted, hidden or manipulated.
Whether attackers accessed confidential messages or attachments.
Whether fraudulent communications originated from the compromised account.

If required, our Cloud Forensics and Email Forensics services can be combined into a single investigation.

Fraud And Internal Investigations

Cloud systems may contain valuable evidence in fraud, corruption and other internal investigations.

Depending on the case, we can investigate activity involving:

Documents and spreadsheets.
Cloud-hosted email.
File sharing.
Collaboration platforms.
User accounts.
Access logs.
Audit trails.
Document modification history.
Deleted information where recoverable.
Communication between relevant users.

Cloud evidence can help establish who performed an activity, what information was involved, and when it occurred.

Litigation And Other Legal Investigations

Cloud-hosted information is increasingly relied upon during civil litigation, criminal investigations, disciplinary matters, arbitration and other legal proceedings.

We assist with forensic acquisition and preservation of relevant cloud-hosted information while maintaining evidentiary integrity and documenting the acquisition process.

The resulting evidence may assist in establishing:

The existence of particular documents or communications.
When files were created, accessed, modified, shared or deleted.
Which users accessed particular information.
Communication between relevant parties.
The chronology of events.
Whether available digital evidence supports or contradicts statements made by the parties involved.

Cloud Evidence Acquisition And Preservation

The first step in a cloud forensic investigation is normally to identify and preserve the relevant evidence.

Cloud evidence can change rapidly. Audit information may be retained only for limited periods; files may be deleted or overwritten; accounts may be disabled; and retention policies can affect what information remains available.

Where appropriate, we can help you:

Identify potentially relevant cloud accounts and services.
Determine what evidence may be available.
Acquire relevant emails, documents, files and metadata.
Preserve available audit and activity logs.
Extract relevant account information.
Preserve cloud-hosted evidence in an appropriate forensic format.
Calculate cryptographic hash values for acquired evidence where applicable.
Maintain records relating to the acquisition and chain of custody.

The evidence available depends on the cloud platform, subscription level, account configuration, retention policies, and lawful access for the investigation.

Microsoft 365 Forensics

Microsoft 365 environments can contain extensive evidence relating to user activity and business communications.

Depending on the investigation and available permissions, evidence may include information from:

Exchange Online.
Microsoft Outlook.
OneDrive.
SharePoint.
Microsoft Teams.
Microsoft Entra ID.
Microsoft 365 audit records.
User and administrative activity logs.

This information can be particularly valuable when investigating compromised accounts, employee misconduct, intellectual property theft, fraud and unauthorised disclosure of company information.

Google Workspace And Google Account Forensics

Google-hosted services can similarly contain important evidence concerning communications, file activity and account access.

Depending on the account and information available, an investigation may involve:

Gmail.
Google Drive.
Google Docs.
Google Sheets.
Google Workspace audit information.
Account login and security activity.
File sharing and permission information.
Relevant account metadata.

Cloud Storage Forensics

Cloud storage platforms can provide important evidence relating to the movement and sharing of information.

Our investigation may include cloud-hosted data from services such as:

Microsoft OneDrive.
Google Drive.
Dropbox.
Apple iCloud.
SharePoint.
Other business and personal cloud storage platforms.

Evidence may include files, folders, metadata, synchronisation information, sharing activity and account activity, depending on what the service makes available.

Deleted Cloud Data

Deleting information from a cloud platform does not mean every copy disappears immediately.

Depending on the service, account configuration, retention policies and the time elapsed since deletion, information may still exist within:

Deleted-item locations.
Version histories.
Retention systems.
Email archives.
Backups.
Synchronised computers.
Mobile devices.
Local application databases and caches.
Other users’ accounts or shared folders.

If necessary, we can investigate both the cloud environment and the devices that accessed it to determine if additional copies or artefacts remain.

Cloud Activity Timeline Reconstruction

One of the most useful outcomes of a cloud forensic investigation is the reconstruction of a timeline.

Evidence from multiple sources may be combined to establish events such as:

User login.
File access.
File download.
File modification.
File sharing.
Permission changes.
Email activity.
File deletion.
Account configuration changes.
Synchronisation with another device.

This information can be correlated with computer, mobile phone, server, email, and other forensic evidence to provide a clearer picture of what occurred.

Forensic Reporting

Where required, the findings of the investigation can be documented in a comprehensive digital forensic report.

Depending on the mandate, the report may include:

Investigation scope and objectives.
Sources of evidence examined.
Acquisition methodology.
Evidentiary integrity and chain of custody.
Relevant forensic findings.
Event timelines.
Supporting logs and artefacts.
Interpretation of the evidence.
Limitations affecting the investigation.
Conclusions based on the available digital evidence.

Reports can be prepared for internal investigations, disciplinary proceedings, insurance matters, litigation and other legal proceedings.

Need Help?

If you believe cloud-hosted evidence may be relevant to an investigation, preserve the affected accounts, audit information, and devices as soon as possible. Avoid deleting accounts, changing configurations, or allowing affected devices to be reused before relevant evidence is identified and preserved.