Cloud Files, SaaS Account Records, API Collections
Cloud and SaaS Forensics Built on the Provider's Own Logs
A shared folder emptied the week before a resignation, a customer list exported from Salesforce, a Dropbox link that reached the wrong people: the platform logged every step. Global Digital Forensics preserves the files, versions, sharing records and audit logs through the provider's own interfaces and turns them into one timeline, with every entry traced to a provider record.
From the Account in the Log to the Person
We establish who did what inside a cloud platform by correlating its audit trail with authentication, device, application and timing evidence. Human accounts, service principals, integrations and delegated sessions all write to the same trail, and separating them is what turns an account name in a log into a finding about a person.
Each platform has its own edition, roles, API or export path, configured audit events, export limits and retention schedule. We confirm those parameters for every source before collecting, so the plan captures the files, versions, deleted items and activity logs the platform actually holds.
The handoff to counsel includes a source and version map, the collection query or job record, every transformation, any inaccessible period and the reconciliation exceptions. The earlier we preserve, the more of the record you keep. The primary references are public: Microsoft Purview audit log activities, Google Workspace Drive log events and AWS CloudTrail data events.
If the account in your matter could have been a service principal or a delegated session rather than the person named in the caption, get a free consultation before anyone draws a conclusion from the log.
Systems Experience Behind Every Cloud Examination
Global Digital Forensics has served law firms and businesses since 1992. Joseph Caruso, our founder, began his technology career in 1980 in software development, mainframe databases and real time transaction systems. His consulting expert work in an American Express consumer class action involved real time transactions, mainframe databases, source code and system configuration, and his Bank One shareholder class action work involved credit card transaction and deposit systems. That systems background is what lets us explain how a cloud application produced a record, not merely that it did.
On the first call we name the examiner who would sign the collection record and take the stand, and their credentials are public.
Follow Company Information Across Every Connected Account
Business records move between shared folders, email, messaging tools, CRM and business applications and local computers, and the person who took them rarely used only one. We connect the original files, their versions, their permissions and their activity records to the people and dates in your matter, so the story is told once across all of them.
We work with counsel, security teams and the authorized administrators to identify the relevant accounts and applications, preserve the records, correlate the activity and prepare findings for employee departures, commercial disputes, compromised accounts and discovery. The examiner who collects the evidence is the examiner who explains it.
The fastest start is to tell us which accounts and applications the information touched. Call (800) 868-8189 and an examiner will map the sources with you on the first call.
Files, Versions, Permissions and Logs Answer Different Questions
A document records content. Its version history records how the content changed. Its sharing settings describe who was permitted to reach it. Activity logs add downloads, synchronization, administrative changes and account logins. We compare all of them, because no single source explains an event on its own.
We identify the original file, its owner, the account, the relevant versions and the surrounding activity, and we tie each finding to the records that establish it. Collect early around account closure, staff changes and routine retention cycles, the moments when a platform quietly discards the records you will later need.
Microsoft 365, Google Workspace, Dropbox, Box and Salesforce
Microsoft 365 covers Outlook email, OneDrive and SharePoint documents and the sharing and account activity behind them.
Google Workspace covers Gmail, Google Drive files, permissions and the available Workspace audit logs.
Collaboration and business application examination can include Slack, Teams, Box and Dropbox records, CRM and business applications such as Salesforce, and the linked documents and communications within the agreed scope, collected through each platform’s supported export or API path.
Cloud infrastructure examination can include authorized AWS and Azure records, object storage and identity activity within scope.
For each source we review the export and logging options actually available, choose the API or export path that preserves the most of the record, and document the collection method, dates and handling so the collection stands up when it is challenged.
Remote Collection Coordinated With Your Administrators
Tell us which applications hold the information and who administers them. We arrange authorized access, identify the relevant accounts and date ranges and coordinate collection with your IT team, and users keep working in their accounts during routine remote collection.
We preserve the collected files, activity logs and source records with integrity checks and custody documentation, and we add computer or mobile evidence when the local download, the chat or the USB transfer completes the picture the cloud log began.
Request a free consultation, and the first call will settle which of these steps your matter needs.
Employee Departures and Compromised Accounts, Told From the Record
Picture a departure analysis that connects a shared folder download late on a Tuesday night, an email with the same files attached an hour later and a USB device connected to the employee's laptop the next morning. Or a compromised account examination that connects a sign in from an unfamiliar location, a new forwarding rule and the file access that followed. Each finding rests on the sequence across sources, never on one isolated event.
For a departing employee, employee exit Core Analysis delivers an examination at a flat rate for an agreed scope. Explore executive departures, partner separations or business email takeover analysis when the matter calls for one of those.
A Cloud Report Written to Be Acted On
Deliverables include an evidence inventory, an account and file access timeline, a sharing analysis and the exhibits that make them readable. We explain account identifiers, timestamps and source records in plain language, so a general counsel, a claims adjuster and a jury can each evaluate the findings on their own terms.
For litigation we connect the examination with eDiscovery collection and production and expert reports and testimony, and our computer, email and cloud forensics service brings the devices and the accounts into one examination.
To see how the report feeds review and production, read about our cloud eDiscovery collections before the first call.
Cloud Sources We Examine
Files, versions and sharing records from OneDrive, SharePoint, Google Drive, Dropbox and Box; records exported from Salesforce and other business applications; Slack and Teams messages; identity provider sign in logs; and AWS CloudTrail and Azure activity logs when the matter reaches infrastructure.
Retention Clocks Across Platforms
Every platform keeps activity for its own period, and lower license tiers often keep less. We list the retention of each source on the first day and collect the shortest lived records first.
Send the question and the sources you know about, and we will map the examination with you.
Frequently asked
Downloads, Sharing and Departing Employees
Can you establish who downloaded or shared a cloud file?
We examine file activity, sharing records, account identifiers and login evidence to establish the recorded access and transfers, then connect those findings with the computer, email and application records that tie an account to a person. The report shows which records carry each step of the attribution.
Do you collect Google Drive, OneDrive, Dropbox and Box files?
Yes. We collect authorized Google Drive, OneDrive, SharePoint, Dropbox and Box sources through their supported export or API paths, together with file metadata, versions and the available activity logs, and we document the method so the collection can be defended.
Can you review external sharing after an employee leaves?
Yes. We examine the sharing permissions, the file movement and the communications around the departure, and the timeline shows how company information was handled, link by link.
What should we preserve first?
Call us and describe the affected accounts, files and dates. We identify the activity logs with the shortest retention, the original documents, the version history and the connected devices, then coordinate preservation with your authorized administrator before anything expires.
Can you provide discovery production and testimony?
Yes. The examination can include data prepared for review, production in the agreed format, a forensic report and expert testimony. We plan those deliverables with counsel at the start so the collection supports them.
GDF does not accept pro se litigation cases, and GDF may decline matrimonial or family law cases at our discretion.
Reviewed by Joseph Caruso, Founder, CEO and CTO, CISSP. Last reviewed .