When data and applications are moved off the local personal computer, the forensics investigator may lose the ability to access very critical information for the case. The provenance of a particular file or the time the file was last accessed can often be crucial in determining how the file was used and who had access to it. If the data storage shifts to the cloud, the ability to obtain uncontaminated copies of evidentiary data may be reduced, if not eliminated…
