“Cloud computing”—also known as “the cloud”—is a misnomer and the source of much misunderstanding. The term “cloud computing” refers to multiple devices accessing a central repository of data outside the physical computing environment. The concept dates to the 1960s, and the cloud gets its name from the cloud symbol used by flowchart programs to represent the Internet.
All digital data, cloud-based or otherwise (for our purposes), is stored on a hard drive or other physical mass storage device somewhere. Of special significance in this context is the fact that the drive or device on which the data is stored is typically not in the user’s possession, not under their custody or control, and may be located outside of the court’s jurisdiction or even outside of the country.
Widespread adoption of cloud computing by both individuals and businesses makes this fact incredibly important.
Discovery Challenges of Cloud Storage
Today, much data is not merely backed up to the cloud but stored exclusively in the cloud. This data can be collected and preserved remotely in a forensically sound manner, but only if the credentials for the cloud-based account in question are known or available.
Two key issues with respect to cloud-based ESI are as follows:
- Existence of the Data. The only way you will know if a party has cloud storage accounts or services where ESI may exist is if 1) the party discloses same, 2) an examination of the computers and systems of the party shows evidence of the existence of same, or 3) you happen to discover payment(s) for cloud computing/data storage services in the party’s financial records. (The discovery of previously undisclosed cloud storage accounts is another excellent reason to seek discovery and inspection of the party’s computing devices.)
- No Physical Access/No Recovery of Deleted Data. Because it is extremely unlikely that you (or computer forensic professionals working with you) will ever get physical access to the drive(s) on which cloud-based data is stored, recovery of deleted ESI is likely to be impossible. If cloud data is deemed significant, a preservation demand should be sent to the cloud-based storage host—assuming you know who they are—and consideration should be given to seeking a court order to prevent alteration or deletion of the data.
Cloud Storage Account Logs
For data stored exclusively in the cloud, direct access to the user account is critical not only to obtain the data itself, but also to obtain account logs that will contain essential metadata (e.g., when files were uploaded, accessed, downloaded, modified, etc.). During litigation, it may become necessary to confirm who accessed what, how they accessed it, from where, and when.
All these questions can generally be answered with account logs maintained by the cloud storage providers. Any time a user connects or attempts to connect, the cloud systems record this information, but they don’t retain it forever. These logs typically contain usernames, IP addresses, timestamps, and sometimes information about the type of device or Internet browser being used.
Providers
Click on the logo below to see service of process information and other details for each service provider.
Don't see a provider you are looking for?
We can still help. Click the Provider Request button below, and we'll start the process of getting you what you need.
Provider Request