When people think about digital evidence in family law, they usually picture a phone. But for most of us, the richest record of daily life no longer sits on any single device — it sits in the cloud. iCloud, Google and Microsoft accounts quietly accumulate years of messages, photos, documents, backups and location data. In separation and parenting matters, that data can fill critical gaps: when a device has been lost, replaced, wiped or is simply unavailable, the cloud often still remembers.
What actually lives in a cloud account
Most account holders are surprised by how much their own accounts contain.
Device backups
iPhones back up to iCloud; Android phones back up to Google. These backups can include messages, call logs, app data and settings as they existed at the time of backup. Crucially, a backup made months ago may preserve content since deleted from the handset — one reason cloud sources matter so much in deleted data retrieval. Recovery from backups is possible but never guaranteed: it depends on what was backed up, when, and how the platform retains it.
Photos and their metadata
iCloud Photos, Google Photos and OneDrive typically store images with embedded metadata — capture date and time and, where location services were on, GPS coordinates. A photograph can therefore speak to where someone was and when, which may be relevant to parenting arrangements, relationship timelines or disputed accounts of events. Interpreting this metadata reliably is a task for GPS and location analysis, because settings, time zones and editing can all complicate the picture.
Location history
Google’s location history (Timeline) and similar features can record movements over long periods where enabled. Courts generally treat such records as one strand of evidence to be weighed in context, but they can corroborate or contradict claims about presence, travel and routines.
Email, documents and storage
Gmail, Outlook and their attachments; Google Drive, OneDrive and iCloud Drive documents; calendars and contacts. In property matters these can hold financial records relevant to the duty of full and frank disclosure under the Family Law Act 1975 (Cth) — a theme we explore in finding hidden assets.
Deleted-file retention
Cloud platforms often keep deleted items recoverable for a period — commonly around 30 days in trash or “recently deleted” folders, and sometimes longer through version history. This means a recently deleted photo or document may still be retrievable from the account even though it is gone from every device. These windows close on their own schedule, so timing matters.
The golden rule: lawful access only
Everything above applies to accounts you are entitled to access — your own accounts, or access obtained through a proper legal process. It cannot be said strongly enough: never log into another person’s cloud account without authority. Not your former partner’s iCloud, not a shared-in-practice Gmail that is registered to them, not an account whose password you happen to know from the relationship.
Unauthorised access to accounts may breach Commonwealth and state laws, can expose you to criminal liability, and will likely taint any evidence obtained — potentially harming the very case it was meant to help. If relevant material sits in the other party’s account, the pathway is through your lawyer: disclosure obligations, and the subpoena powers of the Federal Circuit and Family Court of Australia, exist precisely for this.
There is a related caution for anyone concerned about their own safety: shared family accounts can expose your location and data to a former partner. Our domestic violence assistance page and our guide to checking a phone for stalkerware cover securing your accounts safely.
Audit trails: the cloud remembers who logged in
Cloud accounts do more than store content — they log activity. Sign-in histories, device lists, IP records and security alerts can show when an account was accessed and from what kind of device. In practice this cuts both ways: it can help demonstrate that an account was accessed without authority, and it also means covert snooping tends to leave a trail. For anyone tempted to have a quiet look at a former partner’s account: assume it will be visible.
These same audit trails can themselves become evidence — for example, supporting a complaint that a former partner has been accessing your email or tracking your location through a still-linked account.
When cloud extraction fills the gap
A forensic examination ideally starts with the device. But devices get lost, broken, factory reset, traded in or retained by the other party. In those situations, cloud data extraction from the client’s own accounts can recover a substantial portion of what the device held — backups, synced messages, photos with metadata, and account records — without the handset ever being touched.
Cloud extraction done forensically differs from simply logging in and browsing. Proper collection captures data with its metadata intact, documents exactly what was collected and when, and maintains a chain of custody so the material can withstand authentication challenges under the Evidence Act 1995 (Cth). Where findings are disputed, an expert witness report can explain what the data shows — and, just as importantly, its limits.
Practical steps
If cloud data may matter in your matter: secure your own accounts with new passwords and multi-factor authentication; do not empty trash folders or delete “clutter”, since destroying potentially relevant material during proceedings can lead to adverse inferences; note which accounts and devices were shared during the relationship; and get advice early, because retention windows for deleted items expire quietly.
Digital Forensics Group performs lawful, court-ready cloud extractions for separating individuals and family law practitioners across Australia and New Zealand, with honest upfront advice about what is likely to be recoverable. Call +61 499 475 408 or contact us for a confidential discussion.
