Investigators need evidence from a shared cloud storage system on which the suspect tenant's data is interleaved with data belonging to many other tenants. What must the evidence acquisition approach account for?

Multi-tenancy changes how evidence can be acquired. Physical media in a public cloud hold data from many customers, often striped and interleaved across devices, so imaging whole arrays or seizing drives would expose unrelated tenants' confidential and personal data and may exceed the investigation's legal authority. The appropriate approach is logical, targeted collection through the provider, using its tools or administrative interfaces, scoped to the relevant tenant, accounts and time period, with documentation of the method so the evidence remains defensible. Imaging the entire array prioritizes completeness over proportionality and privacy; legal authorities and data protection laws generally require collection to be limited to what is relevant. Requiring consent from every other tenant is not the standard; the solution is to avoid collecting their data at all, not to seek permission to take it. Seizing physical drives is usually impractical in distributed storage, disrupts other customers, and is unnecessary because logical acquisition, properly documented and hashed, is accepted as evidence. Exam caveat: these constraints are a key reason forensic support terms must be negotiated in cloud contracts before an incident occurs. Operational check: confirm the collection request specifies the tenant, resources and time window, that the provider documents its acquisition method, and that delivered data is hashed and entered into the chain of custody on receipt.