The evidence isn't on the device any more. It's in the cloud.
Most matters that reach a solicitor's desk today turn on records that never lived on a single hard drive: a document edited in SharePoint, a file shared out of a personal Dropbox on a Friday evening, a Slack thread, a Teams call log, an email that "no longer exists" in either party's mailbox. We acquire and examine those records lawfully, preserve them to evidential standards, and report them so a court can rely on them.
Cloud evidence behaves differently from device evidence. It sits in the custody of a third-party provider, it changes as people keep working, retention windows close on a schedule nobody in the case controls, and access itself leaves traces. Acquisition therefore has to be planned, the right legal basis, the right API or export route, and hash-verified preservation before anything else is touched.
Every cloud space a legal team is likely to encounter.
Microsoft 365 · OneDrive · Purview
Google Workspace · Google Drive
Email forensics, Outlook 365 & Gmail
Slack · Box · Dropbox
Social media & messaging platforms
Backups, VMs & infrastructure
Defensible acquisition, from legal basis to exhibit.
There is no write-blocker for the cloud. Defensibility comes from process: authority to access, preservation before examination, logged and hash-verified collection, and a custody record covering every step.
Authority
Consent, employer ownership, court order or provider disclosure, the lawful basis is established and documented before any account is touched.
Preservation
Litigation holds, retention locks and immediate exports, stopping the clock on rotation, expiry and deliberate deletion.
Acquisition
API-based collection with every request logged, exports hash-verified on receipt, and scope kept proportionate to the issues.
Analysis & report
Timeline reconstruction across platforms, correlated with device artefacts, reported to CPR 35 / CrimPR 19 standards.
How cloud forensics plays out in real matters.
The departing employee: tracing exfiltration through Purview, OneDrive & Teams
A sales director resigns; three weeks later the pipeline follows. How audit logs, sync records and Teams messages built the case for an injunction.
The disputed email: authenticating Gmail & Outlook messages in a contract claim
Two parties, two versions of the same email, six figures at stake. How headers, DKIM and Vault records showed which one was genuine.
The disclosure gap: Slack, Dropbox & social media evidence in litigation
Email disclosure was clean; the real conversation happened elsewhere. Recovering the record from collaboration platforms and social accounts.
Cloud evidence expires on a schedule no one in your case controls.
Audit logs are kept for fixed windows, often 90 or 180 days on standard licences. Deleted mailbox items purge on a timer. Departed employees' accounts are routinely wiped after offboarding. A preservation request made this week can capture what a court order obtained in six months cannot. If cloud data may matter to a current or anticipated matter, the correct time to preserve it is now.