Forensic analysis of cloud-native artifacts

Using Google Docs as a case study, we demonstrate that such artifacts can have a completely different structure-their state is often maintained in the form of a complete (or partial) log of user editing actions. Thus, the traditional approach of obtaining a snapshot in time of the state of the artifacts is inherently forensically deficient in that it ignores potentially critical information on the evolution of a document over time. Further, cloud-native artifacts have no standardized external representation, which raises questions with respect to their long-term preservation and interpretation.