Cloud evidence is often presented as a connector problem: authenticate once, select a source and collect. That interface can conceal the most serious design decision—how much authority the connector receives and how long it keeps it.
For an early forensic service or product, native exports are often a better starting point.
The provider already knows its evidence format
Microsoft, Google and cloud infrastructure providers expose matter, audit, export, snapshot and log mechanisms for their own services. Those mechanisms have their own permissions, retention windows and packaging rules, but they avoid asking a new third party to recreate collection for every data source immediately.
A controlled workflow can:
- define the evidence and date range;
- have an authorised customer administrator, custodian or specialist run the native export;
- transfer the package into approved customer-controlled storage;
- retain provider manifests, logs or signatures where available;
- hash and register the package before analysis.
Persistent connectors expand the security boundary
A direct connector may require broad tenant roles, application credentials, refresh tokens, API permissions and secrets management. It also creates operational obligations:
- monitor provider API changes;
- prevent cross-case or cross-tenant access;
- restrict collection to the agreed purpose;
- log every access and query;
- manage region and data-residency requirements;
- revoke credentials and prove deletion at closure.
Those duties can be justified by repeated demand and clear product value. They should not be accepted merely because a connector looks smoother in a demo.
Ingestion can still become a product
Native-first does not mean manual forever. A defensible product wedge can validate packages, preserve originals, create evidence manifests, normalise selected records and keep every search or analytic result linked to a source record.
Later, customer-executed collection utilities or narrow read-only connectors can reduce friction without turning the product into a universal acquisition engine.
The business value is not “we can download Microsoft or Google data.” It is the ability to establish where evidence came from, connect it to the mobile matter and produce a reviewable result.
Read the resource notes and the questions to resolve in the intended examination sequence.