A decade ago, a digital investigation usually meant imaging a hard drive or extracting a phone. Today, the most important evidence often never touches a device at all — it lives in cloud accounts: email, social media, messaging, file storage, and ride-share or delivery histories. Acquiring that evidence correctly requires a different playbook.
Start with authorization and scope
Before acquiring anything, establish two things in writing:
- Authorization. Confirm you have lawful authority to access the account — consent, a warrant, or a subpoena, depending on jurisdiction and account type.
- Scope. Define exactly which accounts and what data are in scope. Over-collection creates legal exposure and review burden; under-collection risks missing key evidence.
Identify the custodian and their accounts
Cloud evidence is organized around custodians — the people whose accounts you're collecting. Map each custodian to the specific services in scope: which email provider, which social platforms, which cloud storage. A single custodian may have a dozen relevant accounts.
Acquire with integrity built in
When you collect, the goal is a complete, verifiable snapshot:
- Capture metadata, not just content. Timestamps, sender and recipient details, and account identifiers are often as important as the message body.
- Hash at acquisition. A cryptographic fingerprint taken the moment data is collected lets you prove later that nothing changed.
- Record the method and time. Document how and when each account was acquired, so the collection itself is defensible.
Evidence Locker performs each of these automatically: acquisitions are collected, hashed, and logged without the examiner having to assemble the record by hand.
Preserve, then analyze
Once acquired, treat the original collection as sacrosanct. Analyze working copies, never the source. From there you can:
- Search across all acquired accounts for names, keywords, and dates.
- Build a timeline that spans multiple platforms for a single custodian.
- Tag and annotate items of interest for reporting.
Common pitfalls to avoid
- Screenshotting instead of acquiring. Screenshots lose metadata and are trivially challenged. Acquire the underlying data.
- Letting accounts change during collection. Acquire promptly; cloud accounts are live and mutable.
- Skipping the audit trail. If you can't show who touched the evidence and when, expect that gap to be exploited.
Cloud evidence is here to stay, and the investigations that handle it well are the ones that treat acquisition as a disciplined, documented process — not an afterthought. Build integrity in from the first collection and the rest of the case rests on solid ground.