Hi all, I would like to know what artefacts can be collected from cloud storage that are not available in a user system. The usual investigations are done on physical memory (volatile data) and non-volatile data such as files, directories, internet history, and log files. And the remnants left behind by an application (Dropbox or OneDrive) can be collected from Prefetch files, Registry files, link files, event logs, thumbnails pictures within the thumb cache, $Recycle.Bin, synchronized files and folders, account accessed through a web browser...
But, I would like to know what type of artefacts can be collected directly from cloud storages. I have been looking around this but couldn't find anything useful. Even if we identify an artefact, how it can be collected and preserved?
Any help is much appreciated. Thanks in advance.