Cloud and SaaS Collections

What This Solves

Cloud data is not the same as printed documents. A Slack message carries sender, recipient, channel, timestamp, edit history, reactions, and thread context that a simple screenshot cannot preserve. A Teams call might have a recording, a transcript, a chat log, and shared files, all linked by the same meeting ID. Collecting cloud ESI by asking custodians to forward emails or export chats manually introduces authenticity problems that opposing counsel will exploit.

GDF collects cloud and SaaS data directly from the source platform, using authenticated API connections that preserve original metadata in full. The result is a collection that can be traced back to its origin, verified against hash values at every stage, and supported by documentation specific enough to withstand a Daubert challenge or a production completeness dispute.

The eCloudDiscovery Platform

GDF's proprietary eCloudDiscovery platform is a fully functional, forensically sound, secure collection environment built specifically for cloud and SaaS evidence. eCloudDiscovery connects directly to cloud services across email, document storage, collaboration, messaging, and AI applications, collecting all relevant data types while maintaining full chain of custody and authentication from the moment collection begins.

Every collection session through eCloudDiscovery generates a real-time activity log: which service was accessed, under which credentials, at what time, which filters were applied, what data was returned, and what hash values were calculated on the collected output. That log is immutable and becomes part of the matter record. The platform transfers collected data directly to GDF's secure infrastructure, eliminating the manual export and re-import steps that introduce custody gaps in traditional workflows.

eCloudDiscovery supports targeted, filter-based collection, meaning GDF can scope a collection by custodian, date range, keyword, file type, folder location, or any combination the matter requires. Collections are proportional by design. The platform does not pull everything and ask attorneys to sort it out later. It pulls exactly what the scope parameters define, with documentation of those parameters in the collection record.

Supported Platforms

eCloudDiscovery supports direct-source collection from the following platforms:

Microsoft 365

Exchange Online mailboxes (including shared mailboxes and mail-enabled groups), Microsoft Teams messages and meeting recordings, SharePoint document libraries and site collections, OneDrive for Business, Viva Engage (formerly Yammer), and Microsoft To-Do task records. All collections preserve native metadata including thread IDs, reply chains, edit histories, and meeting attendance records.

Google Workspace

Gmail (including all labels, threads, drafts, and deleted items retained in Vault), Google Drive (including Shared Drives, version histories, and permission records), Google Chat messages and spaces, Google Meet recordings and transcripts, and Google Sites content. Collection is performed through the Google Vault and Workspace APIs with audit logging at the account level.

Slack

Public channels, private channels, direct messages, multi-person direct messages, and Slack Connect external communications. Collection includes message text, timestamps, sender information, edit and deletion records, file attachments, emoji reactions, and thread parent-child relationships. GDF collects from Enterprise Grid and standard workspace deployments.

Box

File and folder content, version histories, comments, task records, and collaboration sharing records. Box collections through eCloudDiscovery preserve the original file metadata, upload timestamps, contributor identities, and any access audit logs available at the organizational level.

Zoom

Meeting recordings (video and audio), automated transcripts, in-meeting chat logs, polling records, and whiteboard content. GDF collects Zoom evidence through the Zoom API at the account administrator level, preserving recording metadata including participant lists, join and leave times, and meeting IDs for chain of custody documentation.

AI Collaboration Platforms

Enterprise AI systems are an emerging eDiscovery frontier. GDF supports collection from ChatGPT Enterprise and Google Gemini (Workspace AI) deployments, capturing conversation histories, prompts, responses, and shared outputs available through enterprise-level administrative access. Collection scope and data availability vary by contract and deployment configuration; GDF advises counsel on what is collectible and documents any limitations in the collection record.

Mobile Platforms

For custodians using corporate mobile device management (MDM) environments, GDF can collect cloud-synced mobile data through platform APIs, including iCloud Drive content, Google Workspace data accessed from mobile devices, and collaboration app data synchronized to cloud accounts. For direct device collections, GDF's mobile device forensics team handles physical acquisition.

Our Process

Chain of Custody and Forensic Integrity

Every eCloudDiscovery collection produces a Chain of Custody Record that documents the entire lifecycle of the data from source to delivery: who authenticated to the platform, which accounts were accessed, what data was collected, when each step occurred, and what hash values were calculated. This record is structured to support authentication testimony under Federal Rule of Evidence 901(b)(9) for process-authenticated records and to answer the specific questions courts ask when production completeness is challenged.

GDF's analysts can provide declarations or testimony describing the collection methodology, the authentication steps, the platform-specific evidence of data integrity, and the absence of alterations between collection and production. For complex matters, GDF prepares a Collection Methodology Report that describes the technical process in non-technical terms suitable for court submission.

Targeted Collection, Not Bulk Exports

Many providers default to bulk exports: pull everything, then cull. That approach creates proportionality problems, increases processing costs, and creates custody gaps when large exports pass through multiple hands before review. GDF takes a different position. The filter-first approach means that what goes into the collection is already within scope. Volume is lower, processing time is shorter, and the collection record is specific enough that counsel can defend it with confidence.

For matters where scope is genuinely uncertain, GDF can perform a targeted sampling collection first: pulling a representative set of data to inform culling decisions before committing to full collection. That sample is documented the same way as a production collection, so it can be expanded directly into the full collection if the matter requires it.

Deliverables

For each cloud or SaaS collection engagement, GDF delivers:

• Connection Authentication Records for each platform accessed
• Collection Parameter Documentation: the filters, custodians, date ranges, and data types in scope for each collection session
• Real-Time Activity Logs from eCloudDiscovery for each collection session
• Chain of Custody Record: a complete custody document from source authentication through transfer confirmation
• Hash Verification Report: file-level hash values calculated at collection and verified at transfer
• Collection Completion Report: item counts, volume, date ranges, platform breakdown, and any collection limitations or errors
• Collection Methodology Report: a non-technical description of the collection process suitable for court submission or expert disclosure